Getting Data In

Splunk Enterprise & UF on the same machine

andresito123
Communicator

I have inherited a Splunk installation from the previous administrator where there is a heavy forwarder and a UF installed on the same machine.

Since this is a bad practice in terms of performance, I am planning to remove the UF and copy the relevant inputs files to the Splunk Enterprise instance (which acts as a heavy forwarder).

How can I avoid re-indexing the same logs when copying the inputs configuration from the HF to the UF (mainly Windows Events)?

Thanks.

0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

There are multiple methods you can use to solve this. Below are a few (all will involve first stopping the UF):

Rename the existing directory, then re-create it, and configure the HF to monitor.

Archive/compress the existing files and blacklist that file extension (.zip, .gz, etc.) on the HF.

If your existing files contain a timestamp in the file name, blacklist anything older than when you made the cut over from UF to HF.

Opposite of the above, whitelist any file with a timestamp newer than when you make the change.

Those are a few ideas, but again there are multiple ways to accomplish this.
This documentation may help as well:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Whitelistorblacklistspecificincomingdata

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

andresito123
Communicator

@codebuilder the majority are windows event logs, any ideas on how to archive them?

0 Karma

codebuilder
SplunkTrust
SplunkTrust

There are multiple methods you can use to solve this. Below are a few (all will involve first stopping the UF):

Rename the existing directory, then re-create it, and configure the HF to monitor.

Archive/compress the existing files and blacklist that file extension (.zip, .gz, etc.) on the HF.

If your existing files contain a timestamp in the file name, blacklist anything older than when you made the cut over from UF to HF.

Opposite of the above, whitelist any file with a timestamp newer than when you make the change.

Those are a few ideas, but again there are multiple ways to accomplish this.
This documentation may help as well:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Whitelistorblacklistspecificincomingdata

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

andresito123
Communicator

ok thanks, those workarounds make sense!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...