Quantcast
Channel: Questions in topic: "heavy-forwarder"
Viewing all articles
Browse latest Browse all 727

Splunk Enterprise & UF on the same machine

$
0
0
I have inherited a Splunk installation from the previous administrator where there is a heavy forwarder **and** a UF installed on the same machine. Since this is a bad practice in terms of performance, I am planning to remove the UF and copy the relevant inputs files to the Splunk Enterprise instance (which acts as a heavy forwarder). How can I avoid re-indexing the same logs when copying the inputs configuration from the HF to the UF (mainly Windows Events)? Thanks.

Viewing all articles
Browse latest Browse all 727

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>