Splunk Enterprise Security

Placement of Windows and Unix TA

lohit
Path Finder

Hi all,

I am using ES app and collecting windows and linux logs. I have the following hierarchy of splunk components.

Host-> Universal Forwarder > Heavy Forwarder > Indexer <> Search Head.

I want to know that to get the tranformation done whether placement of Windows and *nix TA on Indexer alone will be sufficient?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi lohit,

in your case, any parsing (transformation) by using props and transforms should be done on the Heavy Forwarder. Splunk to Splunk TCP traffic from the Heavy Forwarder to the Indexer will go directly into the index queue without being parsed again.

hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

as I said before Splunk to Splunk traffic from HFW to IDX will go directly into index queue, no parsing will happen. Your data from the UF will go into the index defined in your HFW props and transforms.

lohit
Path Finder

i have one more confusion. From universal forwarder i have forwarded the logs to default index which is 'main'. As soon as the log will reach HFW, because of placement of Windows and linux TA which have their own indexe paramter defined,they will they be filtered, tranformed and will be forwarded to indexer but on indexer under which indexe these events will.In the main or in the index defined in TA* folders ?

0 Karma

MuS
SplunkTrust
SplunkTrust

basically not. But as always: it depends. If your indexer is already at a steady 99.8% load it could increase to 99.9% - if you know what I mean 😉

0 Karma

lohit
Path Finder

So MuS if i got you correctly i will place TAs on heavy forwarder.

Also in my case some universal forwarder are directly reporting to Indexer so if i place TAs on indexer also. Will it cause any performance degrade ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...