topic splunk DB connect in Splunk Search

splunk DB connect

Prakash493 — Wed, 08 May 2019 20:57:50 GMT

Hi Currently we have Splunk db connect installed on heavy forwarder and we have inputs configured on heavy forwarder version 3. Where we have outputs setup on search head that used some spl query to run. I want to use outputs setup on heavy forwarder but when i run those splu queries i am not getting any data , is their any way that i can make my heavy forwarder talk to my search heads to get the data or which is recommended to use outputs on heavy forwarder or in search heads ?

Re: splunk DB connect

koshyk — Wed, 08 May 2019 21:26:14 GMT

The concept of "outputs" setup in SH is wrong and HF should NOT talk to Search Heads.

The proper way to do for your case is

Install DBconnect inputs in Heavy Forwarder
Ensure the outputs.conf of Heavy Forwarder sends data to Indexers
Ensure your SH reads from indexer. The data is shared from Indexer. So any SH should work afterwards.

In Summary , redirect all data from Heavy Forwarder to Indexer

Re: splunk DB connect

Prakash493 — Wed, 08 May 2019 21:29:28 GMT

Ok got it my inputs are on heavy forwarders whereas my outputs are on search head now if i move my outputs of db connect from search head to HF i am not getting any data your answer satisifies me to have outputs of db connector on search head so it will read data from indexers , dis i understand correct ?