topic Re: Question on indexing in Getting Data In

Question on indexing

hrithiktej — Fri, 01 Sep 2017 22:52:55 GMT

We have 2 linux boxes that serve as indexers plus our syslog servers, there is no fowarder in picture since we have syslog and indexer on the same box. I was wondering how does the indexing happen without the forwarder how is indexer picking up logs from syslog folder.

Re: Question on indexing

gjanders — Sat, 02 Sep 2017 00:27:37 GMT

A Splunk indexer is a Splunk enterprise installation and can therefore have an inputs.conf.

An indexer's primary purpose is to index data, but it can also read data from it's own filesystem for indexing (it does this for internal logs by default, in the case you mentioned it is likely reading from the syslog directories).

However if you have an indexer cluster you might want to have a forwarder (on a separate machine) to receive syslog data and then send the data down to the indexer cluster to ensure the data is evenly spread over the cluster members.

Re: Question on indexing

hrithiktej — Fri, 08 Sep 2017 11:37:29 GMT

Thanks I figured out remote logs are received via syslog and then written to a local file on the indexers and monitored locally in our case. And we do have a f5 load balancer before the indexer cluster