cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
GiordanoB
Engager
Member since: ‎08-16-2022
‎08-31-2022
Community Statistics
Posts 2
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎08-16-2022
Activity Feed
View All

Re: Blacklisting from Universal Forwarder to Heavy...

by in Getting Data In
‎08-30-2022 04:59 AM
‎08-30-2022 04:59 AM
@richgalloway appreciate your explanation, in the entire scenario this customer have this farm: 2 x HF (One for Data Inputs and other forwardings and the second (which is my problem) with ONLY Windows). 3 x Indexers, 1 SH and 1 CM. I'm gonna try your solution as a temporary solution. @isoutamo  what i understand with what i've learned from these two HF, they work with 2 locations, each HF works only with their physical locations, still, another job is now to move these UF to the IDX, and i think this will take some time. Do you have a suggestion in how to do that? Thanks for the help in advance. Best regards. ... View more

Blacklisting from Universal Forwarder to Heavy For...

by in Getting Data In
‎08-29-2022 09:57 AM
‎08-29-2022 09:57 AM
Hello guys. Im inherited an splunk enviromment and im kinda new to this, so i'm studying quite a lot.  In my scenario i have something like 100 Windows UF sending info to 01 Heavy Forwarder which sends to 3 indexers and complete the proccess.  Now i want to filter these infos and i'm wondering if i can make a blacklist in the HF to filter these logs, if i can, which is the best way? - In local folder create a inputs.conf and changing from there? I've tried this one and i think it worked, the problem is the logs went to the main index and i could'nt figure out how to change it. - Create some filter in the Indexers? Thanks for the help so far. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-31-2022 12:48 PM
Karma given to
View All