Deployment Architecture

Question about props.conf and light forwarders

responsys_cm
Builder

If I want to use SEDCMD to rewrite values in my data, should it be configured on the forwarder or the indexer?

Thx.

Craig

Tags (1)
0 Karma

jgedeon120
Contributor

If the forwarder is a heavy forwarder, full Splunk install, you can do it there. If not then you need to do it on the indexer.

responsys_cm
Builder

I'm running Splunk 4.3.4. I'm finding that I need to define my line breaking rules and timestamp extraction on the forwarder. Doing it on the indexer doesn't work.

0 Karma

jgedeon120
Contributor

I stand corrected, it can be done on a lightweight forwarder.

http://splunk-base.splunk.com/answers/45411/rewrite-_raw-from-universal-forwarder-not-working

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...