Hi All, currently we are having two heavy forwarder instance which is mainly used to forward the syslog data to the indexer instances. But we could notice that one of the mount point in HF is getting rapidly full ? So we are confused whether the HF is indexing the data and forwarding to indexer instances. How and what configuration file we need to check to determine this behavior?
HF Version 6.4
thanks in advance
↧
How to check whether splunk heavy forwarder is used only for forwarding not for indexeing the data ?
↧