Splunk Search

forwarding - where to define the field extraction : on sender or receiver?

imrago
Contributor

On splunkA I am monitoring an xml log file. It is forwarded to SplunkB in a separate index. Where should I define the multiline event breaking and the field extraction? On sender(splunkA) or receiver(splunkB)?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Please see: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F to learn how to determine where a configuration needs to reside.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Please see: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F to learn how to determine where a configuration needs to reside.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...