Community:LightWeightForwarder

From Splunk Wiki

(Redirected from Deploy:LightWeightForwarder)
Jump to: navigation, search

Deploying a lightweight forwarder

This configuration has been scaled back to do nothing but eat local files and send the unparsed data to another Splunk instance. The parsing seems to take about 80M on my box and most of the CPU time so removing the parsing has a big impact. This configuration will not work if the indexing server is heavily loaded since it will defer all processing to the indexer.

Note: if you use the remote parsing configuration you must change the splunktcp stanza in your inputs.conf to send data to parsingQueue not the indexQueue.

[splunktcp://9997]
disabled = false
queue = parsingQueue
Personal tools
Hot Wiki Topics


About Splunk >
  • Search and navigate IT data from applications, servers and network devices in real-time.
  • Download Splunk