Splunk Enterprise

seperating arcsightlogs in heavyforwarder

sabaKhadivi
Path Finder

I decided to send some juniper and fortigate logs to an arcsight smart connector and then send its output to splunk heavy forwarder and then route them to different indexera based on their source( srx or fortigate) , is it possible when all the logs come from one arcsight host? whats the solution?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...