Hi all,
I have already read several interesting questions regarding this topic. I'd like to verify which approach is better.
This wiki entry really helps: https://wiki.splunk.com/Community:HowIndexingWorks
(topic 4. Detail Diagram - UF/LWF to Indexer)
Goal: Routing of the data to the indexer layer / specific indexer (Indexer S)
Issue: First forwarder can't communicate with the indexer directly (e.g. security etc.)
I see now two options.
Option A:
I perform nothing with the data on the first (or more) forwarders until I reach the forwarder connected to the IX layer.
-> so to speak pass through the data "raw"
Option B:
I cook the data on the first forwarder and on following forwarders I configure the next "queue" to be "typingQueue".
Which should enable the routing capability of each following forwarder in the line.
See following picture below for details:
Which approach seems more feasible?
Thank you in advance for any hints and remarks.
Ps. Good input was found here:
https://answers.splunk.com/answers/463643/does-cooked-data-from-a-hf-forwarder-automatically.html
https://answers.splunk.com/answers/548367/definitions-of-the-route-keys-and-queuenames-for-s.html
I recommend Option A. Have universal forwarders on endpoints send data to heavy forwarders which pass it on to the indexers.
Thank you for the fast reply! I'll further look into Option A.
Do you have any experience with "structured data"?
They seem to be quite special:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata
Please ask that in a new question.