topic Re: Deployment architecture in Splunk Search

Deployment architecture

rashid47010 — Tue, 08 May 2018 14:02:17 GMT

I have
I want to send windows logs through heavy forwarder to indexer.

on windows server, I install universal forwarder and put Heavy forwarder ip:9997.
already configure listening on heavy forwarder.

now how can I see event in indexer.

adonio — Tue, 08 May 2018 14:13:25 GMT

why would you want to use a Heavy Forwarder?
try and avoid using HF unless you must have it
take a look at this link to troubleshoot:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Troubleshooting/Cantfinddata

rashid47010 — Tue, 08 May 2018 14:31:11 GMT

hi
this is just a start of completed architecture.
However I achieve this.
Now where can I filter the events
on HF OR UF ?

Please advise.

somesoni2 — Tue, 08 May 2018 14:38:25 GMT

Did you setup data inputs to collect the data on UF?

FrankVl — Tue, 08 May 2018 14:53:47 GMT

Specifically for windows events, you can filter those using whitelist or blacklist settings in inputs.conf on the UF.

skoelpin — Tue, 08 May 2018 15:17:55 GMT

Theres very specific use cases for using a HF. You should typically let the indexers do the parsing

rashid47010 — Wed, 09 May 2018 05:29:58 GMT

Hi Frank,

Please share some example on this.

FrankVl — Wed, 09 May 2018 07:03:05 GMT

Just have a look at the inputs.conf spec and accompanying examples. Or check out my accepted answer here: https://answers.splunk.com/answers/648353/how-to-limit-a-data-sent-to-indexers-to-only-with.html

jaracan — Tue, 29 Sep 2020 19:29:46 GMT

Hi,