Deployment Architecture

automatic lookup on splunkforwarder

mbrussk
Engager

Hello,

is it possible, to implement automatic lookups on a splunk forwarder?
The reason for this request is, that i´ve already installed the splunk forwarder on a linux-based vpn-server.
The forwarder already monitors the log file of the vpn-process (racoon) and forward it to our central splunk indexer.
But there is a need, to add data to the logfile, befor it is send to the indexer, because the data which has to be added are only available at run-time on the linux system itself and depends on the information of each log line. Therefor i´ve no chance with an lookup at the central splunk indexer.

regards
Michael

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Universal Forwarder only forwards. To do anything else, you must install a Heavy Forwarder.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The Universal Forwarder only forwards. To do anything else, you must install a Heavy Forwarder.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...