Getting Data In

Can you disable indexing for a heavy forwarder and use it only for parsing data?

fstsantos
Engager

Is it possible to disable all indexing operations in a heavy forwarder and use it exclusively for data parsing?

I need to transform the data and forward it to another splunk instance, without any indexing in the forwarder.

Thanks

Tags (1)
1 Solution

strive
Influencer

By default it wont index. Unless you set it true.

indexAndForward = [true|false]  
* Index all data locally, in addition to forwarding it.  
* This is known as an "index-and-forward" configuration.  
* This attribute is only available for heavy forwarders.  
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.  
* Defaults to false.

View solution in original post

strive
Influencer

By default it wont index. Unless you set it true.

indexAndForward = [true|false]  
* Index all data locally, in addition to forwarding it.  
* This is known as an "index-and-forward" configuration.  
* This attribute is only available for heavy forwarders.  
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.  
* Defaults to false.
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...