topic Re: Indexing question on a heavy forwarder in Getting Data In

Indexing question on a heavy forwarder

marvatwork — Wed, 09 Oct 2013 20:38:32 GMT

I have a main indexer in one location (production) that gets inputs from all the systems located in that production location. I have a heavy-forwarder at another location (development) that gets inputs from all the systems at this second location. If I want to keep a local copy of the index at the developement site before forwarding it to the main indexer, do I need another license?

Re: Indexing question on a heavy forwarder

kristian_kolb — Wed, 09 Oct 2013 21:17:08 GMT

They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.

Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.

Re: Indexing question on a heavy forwarder

marvatwork — Wed, 09 Oct 2013 21:30:20 GMT

That seems to work. My next question, is do I get hit twice for the data coming from the development site. For indexing it twice?

Re: Indexing question on a heavy forwarder

lukejadamec — Wed, 09 Oct 2013 21:45:28 GMT

No because it is not indexed twice. It is indexed once and then transferred.