topic Re: Do forwarders require indexes.conf? in Getting Data In

Do forwarders require indexes.conf?

jaoui — Wed, 07 Sep 2011 18:30:07 GMT

If i am setting up a heavy forwarder to monitor directories and tag indexes, do i need to create an indexes.conf on it or is specifying an index in inputs.conf sufficient?

Re: Do forwarders require indexes.conf?

rroberts — Mon, 28 Sep 2020 09:52:30 GMT

If you're going to go with the defaults you do not need to setup a $SPLUNK_HOME/etc/system/local/indexes.conf. You can go with the default out-of-the-box $SPLUNK_HOME/etc/system/default/indexes.conf. You also dont need to specify an index in inputs.conf if you want to write to the default main index.

Re: Do forwarders require indexes.conf?

jaoui — Mon, 28 Sep 2020 09:52:33 GMT

i am planning out like 10 indexes on the inputs of this heavy forwarder (it will be monitoring directories written to by syslog-ng)

if i specify the indexes in inputs.conf like:
[monitor:///data/syslog-ng/cisco]
host_segment = 4
index = net_cisco
sourcetype = cisco_syslog

do i need a corresponding entry in indexes.conf on the forwarder for net_cisco? even though the forwarder is not itself indexing data?

Re: Do forwarders require indexes.conf?

jaoui — Thu, 08 Sep 2011 05:51:24 GMT

I learned that Splunk Forwarders do not necessarily need indexes.conf to tag inputs for a given index but there are 3 different scenarios:

When using the configuration files there is no restriction and Splunk will forward correctly without the indexes.conf
When using the CLI, splunk will complain if we try to configure inputs without a corresponding entry in indexes.conf
When using the web, we will only be presented with indexes configured in indexes.conf

Hope that helps others!

Re: Do forwarders require indexes.conf?

MuS — Thu, 08 Sep 2011 14:24:26 GMT

Hi jaoui, no you don't need it on the forwarder