splunk forwarder showing different events indexed than splunk indexer

[remy06]

Hi,

Just to check, I've a splunk forwarder that shows lesser events indexed than on the splunk indexer.Is it suppose to be like this?

For eg, on a windows server I've this forwarder installed and configured to send winevent logs to splunk indexer. The forwarder itself shows 26,434 events indexed while on the splunk indexer shows 253,118.

I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?

[e82than · Accepted solution]

hi remy06,

By not getting your fowarder to keep a copy of the data, the results differ.

"I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?"

R, Ethan Hunt.