I want to know the following in relation to the REST API:
Thanks!
John
1) Yes, depending on the following preconditions:
2) Probably any. Being able to connect to the splunkd webserver at all indicates the process is running.
3) Don't think so. You can forward the splunk logs to your indexer(s), though. Eg. by adding the following to the outputs.conf on your UF/LWF:
[tcpout]
forwardedindex.3.whitelist = _internal
1) Yes, depending on the following preconditions:
2) Probably any. Being able to connect to the splunkd webserver at all indicates the process is running.
3) Don't think so. You can forward the splunk logs to your indexer(s), though. Eg. by adding the following to the outputs.conf on your UF/LWF:
[tcpout]
forwardedindex.3.whitelist = _internal
Thank you Ziegfried! 🙂