Archive

Deployment architecture

rashid47010
Communicator

I have
I want to send windows logs through heavy forwarder to indexer.

on windows server, I install universal forwarder and put Heavy forwarder ip:9997.
already configure listening on heavy forwarder.

now how can I see event in indexer.

Tags (1)
0 Karma

jaracan
Communicator

Hi,

Here is a good reference for your deployment architecture.
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

0 Karma

somesoni2
Revered Legend

Did you setup data inputs to collect the data on UF?

0 Karma

adonio
SplunkTrust
SplunkTrust

why would you want to use a Heavy Forwarder?
try and avoid using HF unless you must have it
take a look at this link to troubleshoot:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Troubleshooting/Cantfinddata

0 Karma

rashid47010
Communicator

hi
this is just a start of completed architecture.
However I achieve this.
Now where can I filter the events
on HF OR UF ?

Please advise.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Theres very specific use cases for using a HF. You should typically let the indexers do the parsing

0 Karma

FrankVl
Ultra Champion

Specifically for windows events, you can filter those using whitelist or blacklist settings in inputs.conf on the UF.

0 Karma

rashid47010
Communicator

Hi Frank,

Please share some example on this.

0 Karma

FrankVl
Ultra Champion

Just have a look at the inputs.conf spec and accompanying examples. Or check out my accepted answer here: https://answers.splunk.com/answers/648353/how-to-limit-a-data-sent-to-indexers-to-only-with.html

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on