Indexer vs universal forwarder

[nareshinsvu]

Hi,

 I have a remote file (on  server 2) which can be accessed directly from my Indexer (on server 1). What is the best and recommended way to ingest data from that file into indexer

1) Read directly from indexer's inputs.conf (monitor://remote-path to the file) - Everything on server 1

2) Install universal forwarder on the target machine and forward data (complete log file. no props and transforms) - indexer on server1 and forwarder on server 2

Whats the main difference between these 2 options? pros and cons?

Thanks

[gcusello · Accepted solution]

Hi @nareshinsvu,

you have a little confusion:

props.conf and transforms.conf are on Indexer in both cases because they work in the parsing, merging and typing phases.

Instead inputs.conf depends on the choose you're working.

There're only one exception to this rule: in the input of csv files, props.conf must be also on Forwarder.

Anyway, answering to your question: if possible using a Universal Forwarder on the target server is the best approach because you optimize the input phase and the network bandwidth.

In addition (if you like) you can encrypt transmission.

The other solution is to use if you cannot install the UF on the target server: e.g. it's an old operative system or there aren't resources or simply you don't want to install nothing on it.

Ciao.

Giuseppe

[gcusello]

Hi @nareshinsvu,

Good!

ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉