Splunk Search

Splunk aggregation

sabaKhadivi
Path Finder

due to the splunk couldn't aggregate logs I want to use arcsight smart connector, I think I should use splunk app for cef, is it correct? and what type of forwarder do I need to use?
if the volume of received logs are huge and we need to seprate logs on indexer without need to replicate, is it to possible to manage them with master node? and how can we define indexer qu antities?

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @sabaKhadivi

  1. Yes, use the Splunk app for CEF. It works well to do most of your extractions
  2. Universal forwarder is typically your best option
  3. If you want to disable replication for some indexes, you can do this in indexes.conf
  4. Typically you set indexer quantities using maxTotalDataSizeMB and frozenTimePeriodInSecs in indexes.conf

All the best :slightly_smiling_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...