Ziad's Discussions

Light forwarder sends directly to an Index on the splunk server
4 Replies

Is it possible to have a splunk light forwarder (with unix enabled) to send its logs to a seperate index on the splunk server? Thanks everyone :)

Started this discussion. Last reply by Ziad Mar 20.

SplunkLightForwarder + script inputs
3 Replies

Hello, is it possible to configure splunklightforwarder to forward cpu utilisation? I've added the lines from the unix app to the splunklightfowarder and nothing's happening. Is there anything else…

Started this discussion. Last reply by Michael Wilde Jan 28.

View All

Ziad's Page

Gifts Received

Ziad has not received any gifts yet

Give Ziad a Gift

Latest Activity

Ziad replied to Ziad's discussion 'Light forwarder sends directly to an Index on the splunk server'

Would that be at the light forwarder side? i am running unix and splunk light forwarder at the lightforwarder.

March 19

Michael Wilde replied to Ziad's discussion 'Light forwarder sends directly to an Index on the splunk server'

you an also set an "index" setting in inputs.conf [monitor://var/log/messages] index=mysweetindex

March 19

Ziad replied to Ziad's discussion 'Light forwarder sends directly to an Index on the splunk server'

Worked perfectly! thanks!

March 17

Ferry Leirissa replied to Ziad's discussion 'Light forwarder sends directly to an Index on the splunk server'

Yes its possible, you can read it on http://www.splunk.com/support/forum:SplunkAdministration/3994 You have to edit the props and transforms (on receive) like : props.conf [host::devhost*] TRANSFORMS-dev = IndexIs-dev [host::prodhost*] TRANSFORMS…

March 17

Michael Wilde replied to Ziad's discussion 'SplunkLightForwarder + script inputs'

Splunk (we) -- disclosure -- I work there -- We need to make that app stuff better and more understandable. "where everything's supposed to go", "more app setups, so you can configure them more". Better management of deployment of apps.

January 27

Ziad replied to Ziad's discussion 'SplunkLightForwarder + script inputs'

I only enabled the app and it worked! the script checks had the index=os in the beginning. Tried it with both on or off and they didn't work. Right now i'm on a light forwarder with unix enabled. I can get everything on the master splunk server with…

January 27

Michael Wilde replied to Ziad's discussion 'SplunkLightForwarder + script inputs'

Put the UNIX app on both the indexer and the forwarder and it should work. Question, is there an "index=os" on your Indexer.. run that search and tell me if there are any events there.

January 27

Ziad added a discussion

SplunkLightForwarder + script inputs

January 27

Ziad is now a member of splunkninja

Welcome Them!

January 20