Hi @dshakespeare_splunk
this topic is quite old, but I hope you'll be notified to help me out with my additional question.
Let's say I forward from one forwarder to another data. The first one performs the parsing but only the second one can perform the routing to the indexers. (Network, Security)
I'd need to restart the "typingQueue" to enable the second forwarder to perform the routing correct?
Would that mean on the second forwarder, I'd have to configure "has_key:_linebreaker:typingQueue" as linebreaker is the only indication that the data is already cooked?
Or is there a different method to do such?
Thank you very much in advance.
Kind regards
Marco
... View more