https://community.splunk.com/t5/Getting-Data-In/Newbie-Question-Getting-Data-into-a-Distributed-Cluster/m-p/15707#M1808 <P>Hey all!</P> <P>I am trying to understand splunk a little better. I am trying to setup a search head and two indexers. I have all that configured (well everything is added into the search head). Now I am wondering, aside from the splunk forwarder handling automatic load balancing between the two index nodes, what is the best practice on getting data into the indexes? Put more clearly, say i want to collect rsyslogd data on port 514. Do I need to configure each indexer, and then make sure that I am alternating which 'nix boxes i am assigning to which indexer? Or do I need to configure the search head as a forwarder, use that as a single point of entry for everything (how well would that scale?) and then let the splunk forwarder LB it between the two indexers? Do i need to create the indexes manually on each index node?</P> <P>Lots of questions, like I mentioned I am new to all this.</P> <P>Thanks!</P> <P>Zach</P> Fri, 18 Jun 2010 01:46:54 GMT zadunn 2010-06-18T01:46:54Z https://community.splunk.com/t5/Getting-Data-In/Newbie-Question-Getting-Data-into-a-Distributed-Cluster/m-p/15707#M1808 <P>Hey all!</P> <P>I am trying to understand splunk a little better. I am trying to setup a search head and two indexers. I have all that configured (well everything is added into the search head). Now I am wondering, aside from the splunk forwarder handling automatic load balancing between the two index nodes, what is the best practice on getting data into the indexes? Put more clearly, say i want to collect rsyslogd data on port 514. Do I need to configure each indexer, and then make sure that I am alternating which 'nix boxes i am assigning to which indexer? Or do I need to configure the search head as a forwarder, use that as a single point of entry for everything (how well would that scale?) and then let the splunk forwarder LB it between the two indexers? Do i need to create the indexes manually on each index node?</P> <P>Lots of questions, like I mentioned I am new to all this.</P> <P>Thanks!</P> <P>Zach</P> Fri, 18 Jun 2010 01:46:54 GMT https://community.splunk.com/t5/Getting-Data-In/Newbie-Question-Getting-Data-into-a-Distributed-Cluster/m-p/15707#M1808 zadunn 2010-06-18T01:46:54Z https://community.splunk.com/t5/Getting-Data-In/Newbie-Question-Getting-Data-into-a-Distributed-Cluster/m-p/15708#M1809 <P>You should forward to a Splunk forwarder (preferably not your search head), which will then distribute the data among the nodes of your indexing cluster. For UDP syslog packets in particular, you can use a hardware load balancer or some other way to scatter the packets, but you can't do this with TCP streams. You don't really need a separate dedicated search head with only two indexers, and if it's similar hardware, I'd say that you will do better using it as a third indexer and then picking one of those and using it as your search head at the same time.</P> Fri, 18 Jun 2010 05:16:53 GMT https://community.splunk.com/t5/Getting-Data-In/Newbie-Question-Getting-Data-into-a-Distributed-Cluster/m-p/15708#M1809 gkanapathy 2010-06-18T05:16:53Z