All Apps and Add-ons

Capture AWS PostgreSQL database from Heavy Forwarder.

Path Finder

Our current Splunk Infrastructure has:

1) 1x Splunk Search-Head: has Splunk_APP_Stream and SPlunk_TA_Stream
2) 2 x Indexers: has Splunk_TA_Stream
3) 1x Deployment App Server: has Splunk_TA_Stream

We are collecting AWS PostgreSQL CloudWatch logs using a Heavy Forwarder containing the Splunk Add-on for AWS. Would be possible to forward logs to our Splunk Search-Head from HF using SPlunk_TA_Stream? If not, would you please provide me with a recommended solution?

Thank you,

Marcio.

Tags (1)
0 Karma

Explorer

ok, I'm not 100% certain but I want to clarify a couple things.
1. Your HF is receiving the data from AWS so it should be sending it to your indexers in the index and with the specified sourcetype
2. Your Search head should already be able to find the data with index=foo sourcetype=bar 'specifics of your search'

if the above isn't correct, then are you trying to search stream data without indexing it? I guess I'm a little unclear on your exact expectations, and I apologize for that. Perhaps you can further clarify exactly what you are trying to accomplish.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!