Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: What is being forwarded when DB Connect 3 is i...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are many other excellent answers here about configuring DB Connect on an HF. However, I am curious about what is being forwarded.
I've done plenty of work with Universal Forwarders sending logs or .csv files. Does DB Connect generate files that are then forwarded? Or does the data forwarding happen without files because of what's in the outputs.conf? I'd love it if someone could explain.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After setting up my own HF, it looks like as long as the SplunkForwarder app is enabled and the receiving instance has been added to the list in "Configure Forwarding", the data forwarding happens without files because of what's in outputs.conf.
The indexes that you want to contain the data on your receiving instance don't even have to exist on the HF, and the HF default setting doesn't index any data.
This is the answer I was looking for. I hope it helps someone in the future.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After setting up my own HF, it looks like as long as the SplunkForwarder app is enabled and the receiving instance has been added to the list in "Configure Forwarding", the data forwarding happens without files because of what's in outputs.conf.
The indexes that you want to contain the data on your receiving instance don't even have to exist on the HF, and the HF default setting doesn't index any data.
This is the answer I was looking for. I hope it helps someone in the future.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- On the HWF, DBX Input > Java Server > JDBC > RDBMS
- On the HWF, Java Server > Local HEC > Indexer pipeline (https://www.splunk.com/blog/2016/12/12/universal-or-heavy-that-is-the-question.html)
- On the Indexers, Indexer pipeline > Disks
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
