Deployment Architecture

How do I get the *nix app on the indexer to include the forwarded *nix data.

labrat
New Member

I have the unix machines forwarding *nix recordes. I can use search to view the records.

How do get the *nix application on the indexer to include those records. I all I see is the local *nix records.

Tags (1)
0 Karma
1 Solution

LCM
Contributor

LCM
Contributor

Yes, it works with a lightweight forwarder!

Check the connection on forwarder:

* grep "Connected to /opt/splunk/var/log/splunk/splunkd.log

Check the connection on the indexer:

* grep "Connection accepted from /opt/splunk/var/log/splunk/splunkd.log

labrat
New Member

I did spend some time looking through this documentation. I may have misunderstood something.

I am using the lightweight forwarder, is that OK.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...