topic Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head? in All Apps and Add-ons

Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

splunkreal — Mon, 28 Nov 2016 11:44:44 GMT

Hello guys,

I've this configuration in a test environment :

1 SEARCH HEAD < (dist. search) > 1 INDEXER

(no clustered environment)

I set up indexes on the indexer then I still added those (dummy) indexes on the search head for management reasons.

The problem is with the Splunk Add-on for Java Management Extensions (JMX) : it's still writing on the local index of the search head! How to tell it to write on the indexer instead?

Thanks!

Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

gcusello — Tue, 29 Nov 2016 09:56:13 GMT

Hi realsplunk,
did you configured your Search Head to forward its logs to the Indexer?

[Settings -- Forward and Receiving]
Configure Forward -- New -- Indexer_IP:9997
Default Value for Forwarding
Splunk restart

After you can see to your Add-On to send logs the index you want.
Bye.
Giuseppe

Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

splunkreal — Tue, 29 Nov 2016 10:09:10 GMT

Good idea, thanks!

However where are then stored internal indexes?

Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

gcusello — Tue, 29 Nov 2016 10:53:35 GMT

Hi realsplunk,
Splunk internal logs are stored in _internal index.
When Splunk doesn't find an index, it puts logs in index=main.
Every way, try this search
index=* sourcetype=yoursourcetype and verify if you have logs and in which index.
Bye.
Giuseppe

Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

aaraneta_splunk — Tue, 06 Dec 2016 04:30:05 GMT

Hi @realsplunk - Did cusello's answer help solve your question? If yes, please don't forget to click "Accept" below his answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

Re: Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

splunkreal — Tue, 06 Dec 2016 08:38:56 GMT

Hi Aareneta, I couldn't try it yet. Thanks.