When do you plan to support Forwarded Events?
I configured WEC in my environment only to find that the collector at the top of the hiarchy, which has the Sumo agent on it, won't send the data through because Sumo doesn't support WEC event Forwarding Channel. Any ideas on when this will occur or other ideas on work around? Thanks, Chuck
Chuck,We currently support Windows Event Collection via our remote windows event collection source. http://help.sumologic.com/Send_Data/Sources/01Sources_for_Installed_Collectors/Remote_Windows_Event_Log_Source I checked with our Product team and here's the response:"The performance optimizations that we have implemented are not compatible with using event forwarding to the same event channel because we rely on sequential eventIDs to keep performance up. We are considering adding support for this aggregation method in the future." Here is an existing idea/feature request which you can vote on or add your comments: https://ideas.sumologic.com/ideas/SL-I-2106 Cheers,Mario
Please sign in to leave a comment.