- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tagging Heavy Forwarders
jotne
Builder
06-29-2022
03:14 AM
This is a tip, not a question. 😃
When you have a large solution, you can see on the log data: what the UF name that data comes from, what Index server data are stored on. What you do not see are what Heavy Forwarders data are passing trough. Here is an app that do just that. Adding an extra field does not use extra license, since only _raw length are calculated.
Make an app that you sends to all HF servere:
app name: set_name_gateway_hf
props.conf (will apply to all data)
[source::...]
TRANSFORMS_set_hf_server_name = set_hf_server_name
transforms.conf
[set_hf_server_name]
INGEST_EVAL = splunk_hf_name := splunk_server
This will use the Splunk HF server name from etc/system/local/server.conf
