Getting Data In
Highlighted

configuring a pass-through

Champion

Hi,

I want to setup a universal forwarder send events to a heavy forwarder (lots of events, with lots of parsing) and then to an indexer, where they will be stored.

My uf will have a inputs/outputs conf file, and my hf will have the same, plus a props/transforms .conf. How do I tell the hf not to index anything?

0 Karma
Highlighted

Re: configuring a pass-through

SplunkTrust
SplunkTrust

Hi a212830,

this is set per default this way, see the docs about outputs.conf:

indexAndForward = [true|false]
* Index all data locally, in addition to forwarding it.
* This is known as an "index-and-forward" configuration.
* This attribute is only available for heavy forwarders.
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.
* Defaults to false.

cheers, MuS

0 Karma
Highlighted

Re: configuring a pass-through

Champion

Thanks. On hfw inputs.conf, I setup the following, and I received possible typo messages for the transforms statement. Can't I do transforms at this level?

[tcp://:19997]
sourcetype = snmp_metrics
TRANSFORMS-set = setnull,setparsing,sethost

0 Karma
Highlighted

Re: configuring a pass-through

SplunkTrust
SplunkTrust

no this must be done in props.conf not in inputs.conf

0 Karma
Highlighted

Re: configuring a pass-through

Champion

Why would a sourcetype be set in props.conf?

0 Karma
Highlighted

Re: configuring a pass-through

SplunkTrust
SplunkTrust

you asked for transforms and the answer for this is, no

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.