Deployment Architecture

Where does logs stored


Hello Splunkers,

I have an enterprise splunk deployment with 4 indexer clisters and a Search Head cluster.

I have installed Sophos app on Search head. I am getting the logs from sophos central servers by api integration method. I would like to know where these logs are stored? How to identify which indexer its storing on.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Look at the field splunk_server. This will tell you the hostname of the indexer that the data is stored on.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...