Hi All, currently we are having two heavy forwarder instance which is mainly used to forward the syslog data to the indexer instances. But we could notice that one of the mount point in HF is getting rapidly full ? So we are confused whether the HF is indexing the data and forwarding to indexer instances. How and what configuration file we need to check to determine this behavior?
HF Version 6.4
thanks in advance
By default it is forwardonly. To be sure, you add this setting to the output.conf on your HF
[indexAndForward]
index=false
The other check could be, look in index=_internal host=heavyforwarder
, if you see events, bingo!!!!
By default it is forwardonly. To be sure, you add this setting to the output.conf on your HF
[indexAndForward]
index=false
The other check could be, look in index=_internal host=heavyforwarder
, if you see events, bingo!!!!
thanks for your input.