Capture AWS PostgreSQL database from Heavy Forwarder.

[di2esysadmin]

Our current Splunk Infrastructure has:

1) 1x Splunk Search-Head: has Splunk_APP_Stream and SPlunk_TA_Stream
2) 2 x Indexers: has Splunk_TA_Stream
3) 1x Deployment App Server: has Splunk_TA_Stream

We are collecting AWS PostgreSQL CloudWatch logs using a Heavy Forwarder containing the Splunk Add-on for AWS. Would be possible to forward logs to our Splunk Search-Head from HF using SPlunk_TA_Stream? If not, would you please provide me with a recommended solution?

Thank you,

Marcio.

[xanthakita]

ok, I'm not 100% certain but I want to clarify a couple things.
1. Your HF is receiving the data from AWS so it should be sending it to your indexers in the index and with the specified sourcetype
2. Your Search head should already be able to find the data with index=foo sourcetype=bar 'specifics of your search'

if the above isn't correct, then are you trying to search stream data without indexing it? I guess I'm a little unclear on your exact expectations, and I apologize for that. Perhaps you can further clarify exactly what you are trying to accomplish.