All Apps and Add-ons

Capture AWS PostgreSQL database from Heavy Forwarder.

di2esysadmin
Path Finder

Our current Splunk Infrastructure has:

1) 1x Splunk Search-Head: has Splunk_APP_Stream and SPlunk_TA_Stream
2) 2 x Indexers: has Splunk_TA_Stream
3) 1x Deployment App Server: has Splunk_TA_Stream

We are collecting AWS PostgreSQL CloudWatch logs using a Heavy Forwarder containing the Splunk Add-on for AWS. Would be possible to forward logs to our Splunk Search-Head from HF using SPlunk_TA_Stream? If not, would you please provide me with a recommended solution?

Thank you,

Marcio.

Tags (1)
0 Karma

xanthakita
Path Finder

ok, I'm not 100% certain but I want to clarify a couple things.
1. Your HF is receiving the data from AWS so it should be sending it to your indexers in the index and with the specified sourcetype
2. Your Search head should already be able to find the data with index=foo sourcetype=bar 'specifics of your search'

if the above isn't correct, then are you trying to search stream data without indexing it? I guess I'm a little unclear on your exact expectations, and I apologize for that. Perhaps you can further clarify exactly what you are trying to accomplish.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...