topic Re: Distributed Summary Indexing from Search Head in Deployment Architecture

Distributed Summary Indexing from Search Head

mattcg — Wed, 03 Nov 2010 00:35:40 GMT

Hello,

I'm looking to set up our search head to send summary index data it generates back to our indexers in a distributed environment.

I found the following question, and I understand the theory of the answer. However, I don't know specifically how to set up the search head as a forwarder and how to tell it to forward the summaries generated instead of indexing them.

http://answers.splunk.com/questions/5837/summary-indexing-on-a-search-head

Furthermore, is Splunk intelligent enough to determine that summaries generated by a search head and then forwarded back down to our indexers are summaries and therefore not count them toward our license?

Thanks for any guidance.

Re: Distributed Summary Indexing from Search Head

Brian_Osburn — Wed, 03 Nov 2010 02:40:57 GMT

Hi Matt - Having gone through this before, I can say that anything forwarded from the Search head to the indexers is NOT counted toward your license cost. You can even set up the Search head to use the forwarder license included with the app.

With regards to setting up the Search head as a forwarder, it's the same process as you would use for any other forwarder. You can find the details here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving#Set_up_forwarding_and_receiving:_heavy_or_light_forwarders.

Now, there's one caveat. If you use custom named summary indexes, you'll have to make sure they're created in the indexes.conf on the Indexers as well.

Hope this helps! Brian

Re: Distributed Summary Indexing from Search Head

mattcg — Wed, 03 Nov 2010 02:47:23 GMT

Excellent. That's exactly what I was looking for, and I forgot to mention that we do use custom named summary indexes. I will try the setup as you suggest and report back. Thanks!

Re: Distributed Summary Indexing from Search Head

Jason — Thu, 14 Apr 2011 22:39:37 GMT

Not everything forwarded from a SH to an indexer is license free - only things that are license-free anyways, such as internal logs and summary indexing. It is possible to bust a forwarder license with something like the UNIX app inputs and no indexer to forward to!

Re: Distributed Summary Indexing from Search Head

Splunk_U — Fri, 14 Dec 2012 17:40:37 GMT

I have also tried the same. I have a srch head and two indexers. I tried to forward the summary index from the srch head to both the indexers. Now for one of the Indxers it is working fine but for the other one it is not working.

Re: Distributed Summary Indexing from Search Head

sabaKhadivi — Sun, 28 Apr 2019 06:48:12 GMT

I did it and internal,audit , introspection also copied to indexer, how can I change configuration in the way it exclude internal indexes