Hi all...one of my Heavy Forwarders is relaying much data, we are using it for an intermediate forwarding tier to Splunk Cloud. Many UFs are sending to this HF.
I need to run a search to find what source types the Universal Forwarders are sending to this Heavy Forwarder.
The Heavy forwarder is not running in preview mode. I've run plenty of searches that report both UF/HF activity to the SH....but I really want to understand what is going to this HF without bouncing it and putting it in local indexing/preview mode.
Thanks for any input...!
↧