Hi 🙂 Indexer can forward logs to other servers (forwarding and receiving)and I have to configure IP nad port of the host to which indexer can forward logs. I have two hosts visible in GUI (Forwarding and Receiving): serverA:portA serverB:portB The problem is that I do not want to send all logs to these hosts. I want to send logs from IndexA to hostA  and logs from IndexB to hostB. Can I do it or I cannot ? If yes, how? Thanks and regards, pawel   ... View more

Hi 🙂 I checked this doc https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd?_gl=1*161pvu9*_ga*MTAxNjI5MzU0NC4xNjYyNjM1MTI0*_ga_GS7YF8S63Y*MTY5MzkwNDY1OC40MC4wLjE2OTM5MDQ2NTguMC4wLjA.*_ga_5EPM2P39FV*MTY5MzkwNDY1OC4zNDcuMS4xNjkzOTA0NjYwLjAuMC4w&_ga=2.172375459.1250912549.1693843555-1016293544.1662635124#Send_a_subset_of_data_to_a_syslog_server and changed from TCP to SYSLOG and it also works:   outputs.conf [syslog] forwardedindex.3.blacklist = (.*) forwardedindex.4.whitelist = (indexA) [syslog:syslog_qradar_10_10_10_10_514] disabled = false sendCookedData = false server = 10.10.10.10:514   props.conf: [source::9997] TRANSFORMS-routing = send_to_qradar_syslog_10_10_10_10_514   transforms.conf [send_to_qradar_syslog_10_10_10_10_514] DEST_KEY = _SYSLOG_ROUTING FORMAT = syslog_qradar_10_10_10_10_514 REGEX = .     And the question is - how to change this config (what should I add) in order to send logs from indexA to 514 and logs from indexB to port 12468 ? regards, pawelF ... View more

It is not my decision. The requirement is to send logs from indexer. I did dedicated app on indexer to send logs from one index to qradar port 514 and it works fine: outputs.conf: [tcpout] forwardedindex.3.blacklist = (.*) forwardedindex.4.whitelist = (indexA) [tcpout:tcp_qradar_10_10_10_10_514] disabled = false sendCookedData = false server = 10.10.10.10:514   props.conf: [source::9997] TRANSFORMS-routing = send_to_qradar_tcp_10_10_10_10_514   transforms.conf [send_to_qradar_tcp_10_10_10_10_514] DEST_KEY = _TCP_ROUTING FORMAT = tcp_qradar_10_10_10_10_514 REGEX = .   And now I have to add another rule for indexB to be forwarded from indexer to the same IP but port 12468. I do not how  to do it 😞   regards, pawelF   ... View more

HI 🙂 My indexer has to forward some logs to Qradar to 2 different ports: logs from index A > Qradar port 12468 logs from index B > Qradar port 514   regards, pawel ... View more

I would like my Splunk to monitor PostgreSQL database. I have also installed Splunk Stream and all dashboards work fine but Database Activity is empty and I do not know how to connect to database.   regards, pawelF ... View more

Thanks for info. Is there any other way to monitor db from Splunk ? ... View more

One more thing I have just noticed.... when it works as Forwarder, the task server cannot start but when I changed the license group to Enterprise the task server started. The problem is that I need a Heavy Forwarde with DB connect working... ... View more

  I did it many times od Search Head and it always worked. I did it exactly the same way on HF and it does not work. I checked path to Java, I restarted Splunk several times and I still get this error message 😞 ... View more