We have a single inputs.conf stanza that sends the data from "targetLog.log" to a different indexer, "indexerB", than everything else being sent from that forwarder. When the app is enabled, the Universal Forwarder (UF) also sends its internal logs to that same indexer. It should only be sending data from "targetLog.log" and not the internal logs. When I found out, I attempted to force the internal logs to only be sent to the correct indexers, "indexerA", through the props.conf and transforms.conf. That didn't seem to work either, even though they're supposed to override the inputs.conf which overrides the outputs.conf. Why would it still send the internal logs to indexerB even when I've specifically told it not to? I don't have direct access to the UF, so certain methods of troubleshooting prove challenging. inputs.conf [monitor://targetLog.log] disabled = 0 index = dest_index sourcetype = dest_sourcetype _TCP_ROUTING = indexerB outputs.conf [tcpout:indexerB] autoLBFrequency = 60 autoLB = true compressed = false server = indexerB_1:9997, indexerB_2:9997 [tcpout:indexerA] server = indexerA_1:9997 props.conf [source::*/var/log/splunk/*.log] TRANSFORMS-linux_internal_logs_to_indexerA = internal_logs_to_indexerA [source::*\\var\\log\\splunk\\*.log] TRANSFORMS-windows_internal_logs_to_indexerA = internal_logs_to_indexerA transforms.conf [internal_logs_to_indexerA] SOURCE_KEY = _MetaData:Index REGEX = _.* DEST_KEY = _TCP_ROUTING FORMAT = indexerA At this point, I have no idea what's going on to cause it or if it's even preventable. I tried pushing a custom app to retrieve btool info, but then I had to deal with Splunk not properly parsing the data. It'd merge the output from one command but wouldn't do it for others. I'd have separate events for each line and wouldn't be able to tell which line went to which stanza, even though I specified "SHOULD_LINEMERGE = true". That's a problem in and of itself that I don't have time to mess with right now. Anyone have any thoughts on why it would still send the internal logs when 1) I only told it to forward data from targetLog.log, and 2) I've even specifically told it not to forward the internal logs? ... View more

According to the top answer in the question titled "Deployment Server - when app is redeployed, what is overwritten" (url listed below), the deployment server creates a hash of an app and compares it to the hash of what it has and then decides accordingly. Is there a file or database somewhere on the deployment server that contains the listing of hashes by app and computer? I would like to be able to retrieve them to validate the users aren't modifying anything on the universal forwarders. I want to get those hashes and then compare them to a hash of what's currently on the machine. I could write a script to go through and do this myself, but if there is some type of backend functionality Splunk has that I'm unaware of, that would be wonderful. Maybe there is already a different way to prevent a user from altering anything? ... View more