topic Re: App/Add-on in Getting Data In

App/Add-on

BRFZ — Tue, 26 Mar 2024 08:40:56 GMT

Hello,

I have an architecture with a single SH and two indexers. I've installed the Splunk for Microsoft 365 add-on on the search head, so the collected logs are stored in the search head's index, but I want them to be stored on the indexers. Can you help me?

Thank you.

Re: App/Add-on

PaulPanther — Tue, 26 Mar 2024 08:57:04 GMT

1. Create the neccessary indexes on your indexer

2. Configure Best practice: Forward search head data to the indexer layer - Splunk Documentation

Re: App/Add-on

BRFZ — Tue, 26 Mar 2024 09:00:43 GMT

@PaulPanther Thank you for your response, and does it not have any impact given that the indexers are not in a cluster?

Re: App/Add-on

PaulPanther — Tue, 26 Mar 2024 09:08:04 GMT

@BRFZ If you have no cluster the data are not replicated. So if one indexer goes down your search couldn't access all data.