topic Add Remote Index to Heavy Forwarder in Getting Data In

Add Remote Index to Heavy Forwarder

caviman2201 — Fri, 27 Jun 2014 14:55:59 GMT

I have several heavy forwarders in my environment and when I configure data inputs on them, to get the forwarder to send the events to my indexer and put them in a specific index, I have to use inputs.conf. Is there any way to add the indexes on my indexer to the available indexes in the drop-down menu on the web interface of the heavy forwarder?

Re: Add Remote Index to Heavy Forwarder

lguinn2 — Fri, 27 Jun 2014 23:22:04 GMT

No, there is not. The drop-down is populated based on the actual indexes that exist on the local machine (ie, the contents of $SPLUNK_HOME/var/lib/splunk.) I don't think it would be a good idea to create those indexes locally...

Re: Add Remote Index to Heavy Forwarder

caviman2201 — Mon, 30 Jun 2014 13:17:17 GMT

So there's really no point to a Heavy Forwarder then over a Light Forwarder if I have to do almost everything in the text files anyway... The problem I'm running into is that I want to be able to use the GUI's text file preview/source type creation wizard AND have the forwarder send the events to my indexer as opposed to indexing them locally...

Are you saying that isn't possible?