Getting Data In

Does the index and sourcetype gets changed when the logs, sent by ryslog linux server, get to the heavy forwarder?

New Member

Hello, we have a splunk instance that is being fed by a splunk heavy forwarder. We have a rsyslog linux server forwarding logs from our network and linux servers to the heavy forwarder, which is setting the index=syslog and sourcetype=syslog. We have our Windows servers sending the event logs using the universal forwarder on each server, setting the index=wineventlogs, to the heavy forwarder as well. On the heavy forwarder, the outputs.conf is set to the splunk instance over port 9997. On the instance, we have the receive port configured. It appears that the universal forwarder sets the source type to wineventlog, so does the index and sourcetype get changed when the logs get to the heavy forwarder, since the inputs.conf is configured as such? Or does the config from the universal forwarder hold?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...