What would be the better solution: deploying Universal Forwarders to each server in the environment or collecting logs in a single place first and then sending them to the indexers.
What would be the pros and cons for both solutions? And if there are 10,000 servers on the network, how to check which forwarder is not forwarding data to an indexer? How to find that a single server in 10,000 servers environment not forwarding data?
↧