Splunk aggregation

[sabaKhadivi]

due to the splunk couldn't aggregate logs I want to use arcsight smart connector, I think I should use splunk app for cef, is it correct? and what type of forwarder do I need to use?
if the volume of received logs are huge and we need to seprate logs on indexer without need to replicate, is it to possible to manage them with master node? and how can we define indexer qu antities?

[chrisyounger]

Hi @sabaKhadivi

1. Yes, use the Splunk app for CEF. It works well to do most of your extractions
2. Universal forwarder is typically your best option
3. If you want to disable replication for some indexes, you can do this in indexes.conf
4. Typically you set indexer quantities using maxTotalDataSizeMB and frozenTimePeriodInSecs in indexes.conf

All the best 🙂