- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk universal forwarder parsing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You cannot parse on the UF but you can easily convert UF to HF. If you do, then all Indexer functions other than writing to index will happen on the HF instead of the Indexer so you will have to move the associated TAs and props.conf files to the HF. You will also suffer extreme inefficiencies of data transfer as indicated in this blog:
https://www.splunk.com/blog/2016/12/12/universal-or-heavy-that-is-the-question.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You do not parse at the universal forwarder. You parse at the indexers. Much of the point of having forwarders is directing the events to be spread across the indexers in order to make searches more effective and faster.
There is a way to parse in a heavy forwarder, but it is complex and can lead to serious issues if done wrong.
What is the real problem you are trying to solve?
HOwever, before you answer that question, please go read the response by somesoni2 on this one, describing the functions and results of the various elements of splunk installation....
https://answers.splunk.com/answers/666121/sourcetype-question-and-confusion.html
