Getting Data In

Why is the Universal Forwarder indexing its own logs?



I have many Universal Forwarders installed in the machines that send logs to one Heavy Forwarder.

This Heavy Forwarder sends log to my indexer.

I do not know why each universal forwarder is sending its own internal logs (splunkd, metrics, etc) and indexing this data. I do not want the internal logs from each universal forwarder.

I've tried to filter these logs in the heavy forwarder, but it's not working.

What can I do?


0 Karma


It is best practice to index _internal logs. Your Distributed Monitoring Console won't fully work without it and you won't really be able to remotely troubleshoot any problems on your UFs.

If you are worried about the amount of data in the index, just adjust frozenTimePeriodinSecs on those indexes so you don't hang on to them for too long

0 Karma

Ultra Champion

You can disable those inputs on the Universal Forwarder.

But usually these internal logs are considered very useful for monitoring the health of those instances and troubleshooting issues with data feeds, so I would highly recommend keeping them enabled actually.

Also: since this is going into _internal index, this is not counting against your license (if that is what you were worried about).

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...