I've noticed LWF's metrics.log were forwarded to the indexer as default in some version of splunk. But, not all the versions. So, which version of LWF will send metrics.log to the Indexer(s)?
(Corrected the list.)
I checked the following versions' default inputs.conf. Here is the list;
4.1.2 : Forwarded
4.1.3 : Forwarded
4.1.4 : Forwarded
4.1.5 : Not Forwarded
4.1.6 : Not Forwarded
4.1.7 : Not Forwarded
4.2 : Forwarded
This is just a default. Of course, you can change the behavior to turn on/off by configuring an inputs.conf.
Gerald: Sorry but my first list was wrong... So, I corrected. It's kinda consistent...or not.
Thank you! This inconsistency is maddening.