https://community.splunk.com/t5/Getting-Data-In/Why-is-scripted-input-not-forwarding-to-peers/m-p/190341#M37909 <P>Hi,<BR /> If there is no need/requirement for local indexing, it can be disabled:</P> <PRE><CODE>Go to Splunk install directory cd bin ./splunk disable local-index ./splunk restart </CODE></PRE> <P>You can explicitly define your data inputs in your inputs and outputs.conf. Assuming it's a Linux env and you are using default ports..Eg:</P> <PRE><CODE>inputs.conf [script:///Path to your script] disabled = false interval = your_interval (cron or secs) sourcetype = your_sourcetype index = your_index_on_cluster outputs.conf [indexAndForward] index = false [tcpout] defaultGroup = your-group [tcpout:your-group] server=idx1:9997,idx2:9997,idx3:9997 </CODE></PRE> Tue, 19 May 2015 13:41:53 GMT Yasaswy 2015-05-19T13:41:53Z https://community.splunk.com/t5/Getting-Data-In/Why-is-scripted-input-not-forwarding-to-peers/m-p/190340#M37908 <P>Our setup comprises of 1 heavy forwarder, 3 searchheads and 3 peers/indexers all in the clustered environment. <BR /> We are trying to create a scripted input on the heavy forwarder. We need the scripted input to output the data on an index on the peered cluster. When we try to create the scripted input on the heavy forwarder via the UI only the local indexes on the heavy forwarder show up. </P> <P>How can we achieve our main objective without storing data on the heavy forwarder and only storing it in on the indexers.</P> Tue, 19 May 2015 00:05:52 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-scripted-input-not-forwarding-to-peers/m-p/190340#M37908 tdiestel 2015-05-19T00:05:52Z https://community.splunk.com/t5/Getting-Data-In/Why-is-scripted-input-not-forwarding-to-peers/m-p/190341#M37909 <P>Hi,<BR /> If there is no need/requirement for local indexing, it can be disabled:</P> <PRE><CODE>Go to Splunk install directory cd bin ./splunk disable local-index ./splunk restart </CODE></PRE> <P>You can explicitly define your data inputs in your inputs and outputs.conf. Assuming it's a Linux env and you are using default ports..Eg:</P> <PRE><CODE>inputs.conf [script:///Path to your script] disabled = false interval = your_interval (cron or secs) sourcetype = your_sourcetype index = your_index_on_cluster outputs.conf [indexAndForward] index = false [tcpout] defaultGroup = your-group [tcpout:your-group] server=idx1:9997,idx2:9997,idx3:9997 </CODE></PRE> Tue, 19 May 2015 13:41:53 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-scripted-input-not-forwarding-to-peers/m-p/190341#M37909 Yasaswy 2015-05-19T13:41:53Z