Getting Data In

Does the index and sourcetype gets changed when the logs, sent by ryslog linux server, get to the heavy forwarder?

New Member

Hello, we have a splunk instance that is being fed by a splunk heavy forwarder. We have a rsyslog linux server forwarding logs from our network and linux servers to the heavy forwarder, which is setting the index=syslog and sourcetype=syslog. We have our Windows servers sending the event logs using the universal forwarder on each server, setting the index=wineventlogs, to the heavy forwarder as well. On the heavy forwarder, the outputs.conf is set to the splunk instance over port 9997. On the instance, we have the receive port configured. It appears that the universal forwarder sets the source type to wineventlog, so does the index and sourcetype get changed when the logs get to the heavy forwarder, since the inputs.conf is configured as such? Or does the config from the universal forwarder hold?

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...