Placement of Windows and Unix TA

[lohit]

Hi all,

I am using ES app and collecting windows and linux logs. I have the following hierarchy of splunk components.

Host-> Universal Forwarder > Heavy Forwarder > Indexer <> Search Head.

I want to know that to get the tranformation done whether placement of Windows and *nix TA on Indexer alone will be sufficient?

[MuS]

Hi lohit,

in your case, any parsing (transformation) by using props and transforms should be done on the Heavy Forwarder. Splunk to Splunk TCP traffic from the Heavy Forwarder to the Indexer will go directly into the index queue without being parsed again.

hope this helps ...

cheers, MuS

[MuS]

as I said before Splunk to Splunk traffic from HFW to IDX will go directly into index queue, no parsing will happen. Your data from the UF will go into the index defined in your HFW props and transforms.

[lohit]

i have one more confusion. From universal forwarder i have forwarded the logs to default index which is 'main'. As soon as the log will reach HFW, because of placement of Windows and linux TA which have their own indexe paramter defined,they will they be filtered, tranformed and will be forwarded to indexer but on indexer under which indexe these events will.In the main or in the index defined in TA* folders ?

[MuS]

basically not. But as always: it depends. If your indexer is already at a steady 99.8% load it could increase to 99.9% - if you know what I mean 😉

[lohit]

So MuS if i got you correctly i will place TAs on heavy forwarder.

Also in my case some universal forwarder are directly reporting to Indexer so if i place TAs on indexer also. Will it cause any performance degrade ?