Currently I have a security appliance sending JSON data via HTTP POST to an all-in-one stand alone Splunk test instance.
Now I want to send the JSON data to an intermediate Heavy Forwarder in production (which feeds the indexers).
The test instance is receiving the json data via HTTP POST. A Splunk user account was created to pass the RESTful API data with a RESTfulAPI role and edit_tcp capabilities. The security appliance is configured with the username and password created previously, and is sending data to:
https://<SplunkAD.DR.ESS>:<PORT>/services/receivers/simple? host=<SecurityApplianceAddress>&source=wmps sourcetype=fe_json
The stand alone test instance has an enabled receiver directly on the indexer (I believe) and receives the data without a problem.
At this point I need to reconfigure the security appliance to send data to the heavy fwdr and I am not sure how to set up a receiver on the heavy forwarder so that it will act the same as the test instance. After the connection is established I would like to edit down the amount of data from the security appliance to only the desired fields by changing the .conf files.
Any advice or reference is appreciated.
To have your heavy forwarder send to the indexers without taking a double license hit, make sure that you set
inputs.conf) like this:
[tcpout] defaultGroup=YourIndexerGroupHere indexAndForward=false
Thank you for the instructions. When I checked we had that already setup outputs.conf like that.
I am currently trying to find out where we went wrong but as I move thru the flow I will find it and post the resolution.
Currently the security appliance acts as a server to the heavy fwder, and we don't need inputs.conf because the appliance sends host, sourcetype, index, time. I think we just mis-configured where we assigned the index to... but still looking
You can use same method, as you were doing with single test instance
In case you can modify header of the HTTP Post, you can also have a look at HTTP Event Collector.
Thank you for the reply, I got the security appliance to send to the heavy forwarder, but now I need a inputs.conf to send it to the indexers.
Any advice on sending this to the indexer is greatly appreciated.