When configuring data forwarding to an indexer on a Splunk forwarder, it appears to be possible to do most of the configuration of the CLI except for the option of maintaining a local copy of the data on the forwarder...
How do I disable this via a CLI command?
Forums: SplunkGeneral: Disable local copy on Splunk forwarder via CLI
Previous Topic: Hosts not sending logs? | Next Topic: extract a value from an indexed field
Posts 1–2 of 2
| Post to this topic
Post to this topic
You must be logged in to post a reply.