topic Re: Heavy Forward in Getting Data In

Heavy Forward

vumanhtai — Wed, 02 Oct 2019 13:34:56 GMT

hello Splunk Team
i want to config Heavy Forward to receive and index then send data to my cluster index?
Thank ALL

Re: Heavy Forward

gcusello — Wed, 02 Oct 2019 13:41:09 GMT

Hi vumanhtai,
to configure your Heavy Forwarder, you have to go in [Settings -- Forwarding and Receiving]
Then use [Forwardering Defaults] to say to locally index and forward.
Then use [Configure Forwarding] to say to the HF wht are the indexers to send logs.
Splunk will ask to restart itself.

Only one question: why do you want to locally index logs?
In this way you pay twice license and you don't need of local logs because you have the Indexers Cluster for searches.

Bye.
Giuseppe

Re: Heavy Forward

vumanhtai — Wed, 02 Oct 2019 13:51:25 GMT

Thank You so much!
Can you give me your contact information?
I have run out of working hours and I want to contact you at another time.

Re: Heavy Forward

gcusello — Wed, 02 Oct 2019 13:59:29 GMT

Continue to use the Community, in this way, your questions and answers will be useful also for other people and you can be helped also by other friends.

Bye.
Giuseppe

Re: Heavy Forward

vumanhtai — Wed, 02 Oct 2019 23:15:20 GMT

Hi Gcusello
I see this message on my entire datamodel, how can I fix it?
"This object has no explicit index constraint. Consider adding one for better performance."