Hello,   Il would like to know if i could forward data based on sourcetype between 2 indexers or between indexer and search head. Il would like to forward only data of a certain sourcetype. Thank you for your help ... View more

Hello, I have an architecture like this : Splunk Universal forwarder 1_N => Splunk Indexer 1 => Splunk Search Head 0 Splunk Universal forwarder 1-N => Splunk Indexer 2 => Splunk Search Head 0 Splunk Universal forwarder 1-N => Splunk Indexer N => Splunk Search Head 0 I would like to know if i could forward data from Splunk Search Head to a third party software I know there is apps like CEP. But i would like to forward data to Splunk Indexer for indexing data aand forward data from Splunk Indexer to Splunk Search Head, and finaly forward data from SplunkSearch Head to a third party software. I don't want to forward from Splunk Forwarder drectly to third party software. I would like a single point (Splunk Search Head) to forward to third party software. May be , i make a mistake with this choice. What the best practice with a good security to avoid exposing all the Splunk Forwarder or all the Splunk indexer to the third party software. I'm sorry for my bad english. Thank you very much for your help.   ... View more

Hi, I would like to search against index with network device log. I would like to know how i could find and combine ospf link down. For example : Equipment 1 interface serial0/0/1 src_ip 192.168.1.10 neighbor interface serial0/1/1 dest_ip 192.168.1.9 count_down=10 Equipment 2 interface serial0/1/1 src_ip 192.168.1.9 neighbor interface serial0/0/1 dest_ip 192.168.1.10 count_down=10 I would like a result to combine the two line above in one line like below, with transaction for example (reverse ip, src_ip=192.168.1.10,dest_ip=192.168.1.9 => dest_ip=192.168.1.10,src_ip=192.168.1.9) : Equipment 1 src_ip 192.168.1.10 Equipment 2 dest_ip 192.168.1.9 count_down=10 Thank you for your help ... View more