topic Re: Find HF used in processing data for certain indexes in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Find-HF-used-in-processing-data-for-certain-indexes/m-p/578268#M102113 <P>For a well-configured environment, the answer is "all of them".&nbsp; HFs aren't specific to a specific index or indexes (at least they shouldn't be).&nbsp; The endpoint forwarders should be round-robining (is that a verb?) their data across all HFs for good data distribution.</P><P>If you're trying to decide how many HFs you need for the new deployment then plan on twice the number of indexers.&nbsp; The ideal number, however, is zero, meaning endpoints send directly to indexers.&nbsp; I realize, however, that that is not always feasible.</P> Tue, 14 Dec 2021 01:00:45 GMT richgalloway 2021-12-14T01:00:45Z Find HF used in processing data for certain indexes https://community.splunk.com/t5/Getting-Data-In/Find-HF-used-in-processing-data-for-certain-indexes/m-p/578264#M102112 <P>Hi,</P><P>We need to move certain indexes to a completely different deployment. I need to make an estimate on how many heavy forwarders are currently being used to process data to these indexes.</P><P>Your advice will be very helpfull</P><P>&nbsp;</P><P>Thanks</P> Tue, 14 Dec 2021 00:32:19 GMT https://community.splunk.com/t5/Getting-Data-In/Find-HF-used-in-processing-data-for-certain-indexes/m-p/578264#M102112 InderSingh 2021-12-14T00:32:19Z Re: Find HF used in processing data for certain indexes https://community.splunk.com/t5/Getting-Data-In/Find-HF-used-in-processing-data-for-certain-indexes/m-p/578268#M102113 <P>For a well-configured environment, the answer is "all of them".&nbsp; HFs aren't specific to a specific index or indexes (at least they shouldn't be).&nbsp; The endpoint forwarders should be round-robining (is that a verb?) their data across all HFs for good data distribution.</P><P>If you're trying to decide how many HFs you need for the new deployment then plan on twice the number of indexers.&nbsp; The ideal number, however, is zero, meaning endpoints send directly to indexers.&nbsp; I realize, however, that that is not always feasible.</P> Tue, 14 Dec 2021 01:00:45 GMT https://community.splunk.com/t5/Getting-Data-In/Find-HF-used-in-processing-data-for-certain-indexes/m-p/578268#M102113 richgalloway 2021-12-14T01:00:45Z