I have inherited a Splunk installation from the previous administrator where there is a heavy forwarder and a UF installed on the same machine.
Since this is a bad practice in terms of performance, I am planning to remove the UF and copy the relevant inputs files to the Splunk Enterprise instance (which acts as a heavy forwarder).
How can I avoid re-indexing the same logs when copying the inputs configuration from the HF to the UF (mainly Windows Events)?
There are multiple methods you can use to solve this. Below are a few (all will involve first stopping the UF):
Rename the existing directory, then re-create it, and configure the HF to monitor.
Archive/compress the existing files and blacklist that file extension (.zip, .gz, etc.) on the HF.
If your existing files contain a timestamp in the file name, blacklist anything older than when you made the cut over from UF to HF.
Opposite of the above, whitelist any file with a timestamp newer than when you make the change.
Those are a few ideas, but again there are multiple ways to accomplish this.
This documentation may help as well:
View solution in original post
@codebuilder the majority are windows event logs, any ideas on how to archive them?
ok thanks, those workarounds make sense!