Getting Data In

splunk forwarder showing different events indexed than splunk indexer

remy06
Contributor

Hi,

Just to check, I've a splunk forwarder that shows lesser events indexed than on the splunk indexer.Is it suppose to be like this?

For eg, on a windows server I've this forwarder installed and configured to send winevent logs to splunk indexer. The forwarder itself shows 26,434 events indexed while on the splunk indexer shows 253,118.

I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?

Tags (2)
0 Karma
1 Solution

e82than
Communicator

hi remy06,

By not getting your fowarder to keep a copy of the data, the results differ.

"I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?"

R, Ethan Hunt.

View solution in original post

e82than
Communicator

hi remy06,

By not getting your fowarder to keep a copy of the data, the results differ.

"I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?"

R, Ethan Hunt.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...