topic Re: Indexing capability in Heavy forwarder and Indexer in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Indexing-capability-in-Heavy-forwarder-and-Indexer/m-p/199205#M39455 <P>You won't need the props.conf and transforms.conf in indexer if you are already parsing the data from heavy forwarder if that is the final data you want. Indexer will take as it is and index them. </P> <P>incase your indexer is not reachable then you may also set persistent queue option. </P> <P>Thanks</P> Wed, 26 Mar 2014 05:25:26 GMT linu1988 2014-03-26T05:25:26Z Indexing capability in Heavy forwarder and Indexer https://community.splunk.com/t5/Getting-Data-In/Indexing-capability-in-Heavy-forwarder-and-Indexer/m-p/199204#M39454 <P>I would like to know the duty of the heavy forwarder and Indexer.<BR /> My inputs is syslog data which is read by heavy forwarder. I had set <STRONG>props.conf</STRONG>, <STRONG>transforms.conf</STRONG> in heavy forwarder itself also in <STRONG>outputs.conf</STRONG> I set the attribute ,</P> <PRE><CODE>indexAndForward = true </CODE></PRE> <P>this will index the data locally and forward parsed data to my indexer. <BR />What will my indexer do ?<BR />Will it just receive the indexed data and store in it mentioned index ?<BR /><BR /> What is the effect of mentioning my props.conf , transforms.conf in my indexer also?<BR /></P> <P>My intension of using Heavy forwarder is to temporarily store the data and forward ,in case if my indexer is down or not-reachabale by forwarder. </P> <P>Please clarify what is the exact conf files i need to concentrate</P> Wed, 26 Mar 2014 03:32:20 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-capability-in-Heavy-forwarder-and-Indexer/m-p/199204#M39454 username021 2014-03-26T03:32:20Z Re: Indexing capability in Heavy forwarder and Indexer https://community.splunk.com/t5/Getting-Data-In/Indexing-capability-in-Heavy-forwarder-and-Indexer/m-p/199205#M39455 <P>You won't need the props.conf and transforms.conf in indexer if you are already parsing the data from heavy forwarder if that is the final data you want. Indexer will take as it is and index them. </P> <P>incase your indexer is not reachable then you may also set persistent queue option. </P> <P>Thanks</P> Wed, 26 Mar 2014 05:25:26 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-capability-in-Heavy-forwarder-and-Indexer/m-p/199205#M39455 linu1988 2014-03-26T05:25:26Z