topic Re: How do I disable local indexing and forward data? in Deployment Architecture

How do I disable local indexing and forward data?

ddrillic — Mon, 29 Apr 2019 20:53:57 GMT

I understand that the best practice is to disable local indexing and forward data from the search heads, cluster master, the deployment servers, etc to the indexers. The syntax for outputs.confI see is -

[indexAndForward]
index = false

[tcpout]
defaultGroup = <group name>
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:<group name>]
server=<list of indexers and ports>

Not sure how to read it because we have the indexAndForward as a stanza and also within the tcpout stanza as indexAndForward = false.

So, we don't want to index but we want to forward. The forward part is done, I assume, via - forwardedindex.filter.disable = true...

Re: How do I disable local indexing and forward data?

harsmarvania57 — Tue, 30 Apr 2019 08:13:04 GMT

Hi @ddrillic,

While looking at spec file of outputs.conf, if you define index = false in [indexAndForward] it supersedes value defined in [tcpout] stanza.

# If the [tcpout] stanza configures the indexAndForward setting, the value
# of that setting overrides the default value of 'index'. However, if you
# set 'index' in the [indexAndForward] stanza described below, it
# supersedes any value set in [tcpout].

When you set forwardedindex.filter.disable = true, splunk do not filter indexes based on forwardedindex.<n>.whitelist and forwardedindex.<n>.blacklist parameters which means every data will be indexed.

By default in outputs.conf below configuration is present

forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry)
forwardedindex.filter.disable = false

Re: How do I disable local indexing and forward data?

ddrillic — Tue, 30 Apr 2019 20:10:06 GMT

Gorgeous as usual @harsmarvania57.

Re: How do I disable local indexing and forward data?

harsmarvania57 — Wed, 01 May 2019 07:58:42 GMT

You're welcome