Getting Data In

Why is the Universal Forwarder indexing its own logs?



I have many Universal Forwarders installed in the machines that send logs to one Heavy Forwarder.

This Heavy Forwarder sends log to my indexer.

I do not know why each universal forwarder is sending its own internal logs (splunkd, metrics, etc) and indexing this data. I do not want the internal logs from each universal forwarder.

I've tried to filter these logs in the heavy forwarder, but it's not working.

What can I do?


0 Karma


It is best practice to index _internal logs. Your Distributed Monitoring Console won't fully work without it and you won't really be able to remotely troubleshoot any problems on your UFs.

If you are worried about the amount of data in the index, just adjust frozenTimePeriodinSecs on those indexes so you don't hang on to them for too long

0 Karma

Ultra Champion

You can disable those inputs on the Universal Forwarder.

But usually these internal logs are considered very useful for monitoring the health of those instances and troubleshooting issues with data feeds, so I would highly recommend keeping them enabled actually.

Also: since this is going into _internal index, this is not counting against your license (if that is what you were worried about).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...