![]() Following is an example of a global tcpout stanza. The header specifies the global stanza for the tcpout processor. While this stanza is optional, there are several attributes that you can set only at the global level, including defaultGroup. The global stanza in nf lets you set any attributes that you want to apply globally. For example, if you specify compressed=true for a target group, the forwarder sends the hosts in that target group compressed data, even if you set the compressed attribute to "false" for the global level. (Optional) You can specify configuration values for single servers (receivers) within a target group.Ĭonfigurations at the more specific levels take precedence over the global level. Most configuration settings can be specified at the target group level. There can be multiple target groups per output processor. A target group defines settings for one or more receiving indexers. (Optional) At the global level, you specify any attributes that you want to apply globally, as well as certain attributes only configurable at the system-wide level for the output processor. You can configure the tcpout processor at three levels of stanzas: The universal forwarder only has the tcpout processor, which uses the header in nf. There are two types of output processors for forwarding data: tcpout and syslog. The universal forwarder must be restarted after you make changes to nf.įor information on nf, see the nf spec file. For purposes of distribution and management simplicity, you can combine settings from all non-default versions into a single custom nf file. If a copy of the file already exists in that directory, because of configuration changes made through the CLI, edit that copy. You should work with a single copy of the file, which you place in $SPLUNK_HOME/etc/system/local/. In addition to any nf files that you create and edit indirectly (for example, through the CLI), you can also create or edit an nf file directly with a text editor. The Windows installation process writes configuration changes to an nf file located in the MSICreated app.If you use the CLI to make changes to universal forwarder output behavior, the CLI creates or edits a copy of nf in $SPLUNK_HOME/etc/system/local.The locations of those versions vary, depending on the type of forwarder and other factors. The forwarder automatically creates or edits custom versions of nf in response to the first three methods. While installing the forwarder (on the Windows universal forwarder only.).There are several ways you can specify forwarding behavior: When you configure forwarding behavior, those changes get saved in custom versions of nf. ![]() The default version in the SplunkUniversalForwarder app has precedence over the version under /etc/system/default.ĭo not edit default versions of any configuration files. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |