Is it possible to forward _internal data of an indexer to a third-party systems? I would like to forward some production events and also all the _internal events of splunk deployment including events of indexers.
.conf21 Now Fully Virtual!
Register for FREE Today!
We've made .conf21 totally virtual
and totally FREE! Our completely
online experience will run from 10/19
through 10/20 with some additional
events, too!
