can splunkd.log be forwarded from Heavy Forwarder to Indexer?

[fernandoandre]

I have a Heavy Forwarder (HF) and an Indexer.

I would like to forward splunkd.log from the Heavy Forwarder to Indexer in order to search this log without having to log in to the HF.

1 - How can I do this?

2 - If possible, can I also do it for Universal Forwarders (how?)?

3 - If I use [monitor://...splunkd.log] and forward it, this will index the file and count to licensing purposes...or not?

If I run: splunk list monitor

Splunk returns that this "splunkd.log" in being monitored (but not sent to Indexer).

Thanks

[yanivdutt]

Even I have same issue. Heavy forwarders are not forwarding _internal logs

[jchampagne]

I've implemented this change, hoping to get the local splunk logs from my heavy forwarders into my main indexer. However, I'm still not seeing anything. After doing some more checking, I've noticed that the _internal index on the heavy forwarders has no events.

Why would my heavy forwarders not be indexing their splunk log files by default?

[dshpritz · Accepted solution]

Yes, you can do this, but by default Splunk does not forward events from _internal. In the outputs.conf, you would turn off the filtering. So in the "tcpout" stanza:

[tcpout]

forwardedindex.filter.disable = true

[fernandoandre]

Thank you. I don't know how but I completely overlooked that attribute when reading it.

I have tested it at HF and works perfectly.