Does the Greylog deployment forward events to the indexer or the forwarder?

[pfabrizi]

I just found out that we need to allow our Greylog deployment to forward events to SPLUNK. It looks like Greylog has an app that does that and can filter, send tcp or udp but what it didn't mention was does it forward to indexer or to a forwarder?

Does anyone have any information on this or familiar with this?

We will have a 10 node single-site cluster, 3 SH cluster and ES, HF and 3 UF, deployment\licsense master, cluster master and health monitor.

Thanks!

[xpac]

Hey,
I just checked the docs you are likely refering too.
They just use a common Splunk TCP input, which could be configured on every Splunk instance, although you usually don't do this kind of thing on an indexer, but on a UF or HF.

Actually, the cleanest solution for this is usually have your source (in this case greylog) write it's data to a file, and then have Splunk read that file. If you ever restart that Splunk instance or it is for any other reason unavailable, you'll most likely loose the data that would be sent during that outage. With a file, Splunk will just catch up from where it stopped before a restart.

Hope that helps!

[pfabrizi]

I am guessing that if I wanted to write directly to the indexer from Greylog it would need a certificate from the indexer?

[xpac]

TCP inputs are unencrypted by default, so no, you won't 😉