topic Re: How to index summary indexes on a Search Head locally, and forward all other data to the indexer? in Knowledge Management

How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Jason — Thu, 31 Mar 2011 22:23:12 GMT

Does anyone have any config pointers for the following scenario:

We have a Search Head, and it runs apps that generate summary index data. We would like it to store its summary indexes locally. But, it is also collecting other data (say, scripted inputs from the UNIX app), and we want to send this other (non-summary, license-using) data to the indexer. How to do this?

Re: How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Jason — Fri, 15 Apr 2011 13:43:40 GMT

Evidently in 4.2 the index forwarding is much more granular.

Per the docs, you can specify exactly which indexes get forwarded in outputs.conf.

Defaults:

[tcpout]
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit

Forward all but indexes starting with Summary:

[tcpout]
forwardedindex.0.blacklist = summary.*
forwardedindex.1.whitelist = .*
forwardedindex.2.blacklist = _.*
forwardedindex.3.whitelist = _audit