Getting Data In
Highlighted

What configuration settings are used by universal forwarders?

Super Champion

Does anyone have a specific listing of what configuration options are honored by the universal forwarder and which ones are not?

I know that parsing and merging happens at the indexer (or intermediate heavy forwarder), but I'm not sure about all the other settings. I read somewhere that the CHARSET has to be set on the universal forwarder, but is that the only one?

I thought a found this in the docs or in a post at one point, but I can't seem to find that information again.

0 Karma
Highlighted

Re: What configuration settings are used by universal forwarders?

Legend
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.