Splunk Search

Splunk aggregation

sabaKhadivi
Path Finder

due to the splunk couldn't aggregate logs I want to use arcsight smart connector, I think I should use splunk app for cef, is it correct? and what type of forwarder do I need to use?
if the volume of received logs are huge and we need to seprate logs on indexer without need to replicate, is it to possible to manage them with master node? and how can we define indexer qu antities?

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @sabaKhadivi

  1. Yes, use the Splunk app for CEF. It works well to do most of your extractions
  2. Universal forwarder is typically your best option
  3. If you want to disable replication for some indexes, you can do this in indexes.conf
  4. Typically you set indexer quantities using maxTotalDataSizeMB and frozenTimePeriodInSecs in indexes.conf

All the best 🙂

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...