topic Re: Heavy forwarder as cluster master in Getting Data In

Heavy forwarder as cluster master

ryastrebov — Sat, 29 Nov 2014 19:53:57 GMT

Hello splunkers!

It is possible to configure heavy forwarder as cluster master?
My heavy forvarder forward all data to peers, not indexing external data.

Best regards,
Roman

Re: Heavy forwarder as cluster master

lguinn2 — Sun, 30 Nov 2014 08:11:14 GMT

You should not use the heavy forwarder as a cluster master, although I suppose it is technically possible.

Re: Heavy forwarder as cluster master

ryastrebov — Sun, 30 Nov 2014 09:30:57 GMT

Why should not I do it?

Re: Heavy forwarder as cluster master

lguinn2 — Mon, 01 Dec 2014 21:02:01 GMT

According to the documentation: "The master has the sole function of managing the other cluster nodes."

Managing Indexers and Clusters of Indexers

Re: Heavy forwarder as cluster master

psow_splunk — Sun, 12 Apr 2015 06:10:18 GMT

The master is designed to function solely as the cluster manager. But I have no issues configuring it to monitor certain path and forwarding it to the indexers in the cluster. So it will still work

Re: Heavy forwarder as cluster master

esix_splunk — Sun, 12 Apr 2015 12:00:06 GMT

Technically you can do this.

However, you need to understand the workload on the HF. If the HF starts to get overtaxed, there will be impact to your cluster in terms of maintaining SF and RF across all the indexers.

As long as you are aware of this, and keep your resources on the HF in check, this can be done. However, this is against Splunk best practices.