We have a syslog server where there are many logs going to the indexer.
Can we configure the Linux Universal Forwarder to send some files to the indexer and others to the Heavy Forwarder to be post processed, thinned out is the goal?
How best to do this?
Two Univ Forwarder instances?
Or can a config deal with this?
Thanks,
MG
↧