https://community.splunk.com/t5/Deployment-Architecture/Forwarder-logs-in-an-indexer-cluster-setting/m-p/225118#M23799 <P>You need a combination of outputs.conf and some settings within. An example is below. The whitelist .* says all indexes, and the the 1.blacklist overrides the already configured settings for blacklisted indexes. This should go into $SPLUNK_HOME/etc/appName/local/outputs.conf</P> <PRE><CODE>[tcpout:INDEXERS] server = indexer1:9997,indexer2:9997 compressed = true autoLB = true forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = forwardedindex.2.whitelist = </CODE></PRE> Wed, 10 Aug 2016 13:20:13 GMT jkat54 2016-08-10T13:20:13Z https://community.splunk.com/t5/Deployment-Architecture/Forwarder-logs-in-an-indexer-cluster-setting/m-p/225117#M23798 <P>Hi,</P> <P>I have recently started migrating our enterprise infrastructure to an indexer cluster from a previous standalone Splunk server infrastructure. Before the migration, I could see all the splunkd.logs from all forwarders in the _internal index on the server. After switching to the cluster, I can no longer see them when searching in index=_internal via the search head. <BR /> I suspect it is due to the fact that _internal is... internal, so it is not clustered among cluster nodes and therefore not searchable via the cluster search head. </P> <P>What is the proper way to view them? I have splunk web disabled on cluster peers for security reasons as it was never supposed to be searched directly. It feels idiotic having this log-centralising product and not being able to see its logs in a central place.</P> Tue, 29 Sep 2020 10:36:24 GMT https://community.splunk.com/t5/Deployment-Architecture/Forwarder-logs-in-an-indexer-cluster-setting/m-p/225117#M23798 asiaque_mBank 2020-09-29T10:36:24Z https://community.splunk.com/t5/Deployment-Architecture/Forwarder-logs-in-an-indexer-cluster-setting/m-p/225118#M23799 <P>You need a combination of outputs.conf and some settings within. An example is below. The whitelist .* says all indexes, and the the 1.blacklist overrides the already configured settings for blacklisted indexes. This should go into $SPLUNK_HOME/etc/appName/local/outputs.conf</P> <PRE><CODE>[tcpout:INDEXERS] server = indexer1:9997,indexer2:9997 compressed = true autoLB = true forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = forwardedindex.2.whitelist = </CODE></PRE> Wed, 10 Aug 2016 13:20:13 GMT https://community.splunk.com/t5/Deployment-Architecture/Forwarder-logs-in-an-indexer-cluster-setting/m-p/225118#M23799 jkat54 2016-08-10T13:20:13Z