topic Re: Monitor Splunk Indexer OS Logs - Port Conflicts? in Getting Data In

Monitor Splunk Indexer OS Logs - Port Conflicts?

aferone — Tue, 22 Nov 2016 22:54:58 GMT

I want to monitor /var/log on all of my Splunk Indexers. However, when I configured this, I was then getting issues connecting to my Heavy Forwarders. I configured an outputs.conf to send the logs to the Heavy Forwarders, then back to the Indexers. This probably doesn't sound right.

How would this be accomplished?

Thanks!

P.S. How would I monitor the /var/log on my Heavy Forwards, Search Heads, etc?

Re: Monitor Splunk Indexer OS Logs - Port Conflicts?

aferone — Wed, 23 Nov 2016 17:19:41 GMT

I think I have it working by not specifying any outputs.conf on the Indexers.

Re: Monitor Splunk Indexer OS Logs - Port Conflicts?

aferone — Wed, 23 Nov 2016 17:19:50 GMT

I think I have it working by not specifying any outputs.conf on the Indexers.