Splunk Enterprise

Tagging Heavy Forwarders

jotne
Communicator

This is a tip, not a question😃

When you have a large solution, you can see on the log data: what the UF name that data comes from, what Index server data are stored on.  What you do not see are what Heavy Forwarders data are passing trough.  Here is an app that do just that.  Adding an extra field does not use extra license, since only _raw length are calculated.

Make an app that you sends to all HF servere:

app name: set_name_gateway_hf

props.conf (will apply to all data)

 

 

[source::...]
TRANSFORMS_set_hf_server_name = set_hf_server_name

 

 

transforms.conf

 

 

[set_hf_server_name]
INGEST_EVAL = splunk_hf_name := splunk_server

 

 

This will use the Splunk HF server name from etc/system/local/server.conf

Labels (2)
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...