Getting Data In

Does the index and sourcetype gets changed when the logs, sent by ryslog linux server, get to the heavy forwarder?

New Member

Hello, we have a splunk instance that is being fed by a splunk heavy forwarder. We have a rsyslog linux server forwarding logs from our network and linux servers to the heavy forwarder, which is setting the index=syslog and sourcetype=syslog. We have our Windows servers sending the event logs using the universal forwarder on each server, setting the index=wineventlogs, to the heavy forwarder as well. On the heavy forwarder, the outputs.conf is set to the splunk instance over port 9997. On the instance, we have the receive port configured. It appears that the universal forwarder sets the source type to wineventlog, so does the index and sourcetype get changed when the logs get to the heavy forwarder, since the inputs.conf is configured as such? Or does the config from the universal forwarder hold?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...