We have Splunk Cloud deployed in our environment and we have built an heavy forwarder server. And here we have placed some props and transforms for filtration but actually when i check the data in Splunk Cloud the Regex is not getting applied and hence forth the data seems to be still the improper format so i want to know how to check whether my server is acting as an heavy forwarder or not.
And also how to check whether it is doing a filtering option before indexing in Splunk Cloud.
have always a small instance of splunk that you can fully control - all in 1
on-board the data and tweak your props and transforms accordingly
verify you see the data as you wish, then package your configurations neatly and move them to your Heavy Forwarder