topic Which indexer should I send data to? in Splunk Search

Which indexer should I send data to?

jmrubio — Fri, 09 Feb 2024 16:02:14 GMT

Hello!

I am trying to send syslogs to splunk from network devices using udp. I have one heavy forwarder and two indexers, does it matter which indexer i set up to listen for the data?

Re: Which indexer should I send data to?

gcusello — Fri, 09 Feb 2024 16:07:08 GMT

Hi @jmrubio ,

usually Heavy Forwarder are used to ingest syslogs.

Then your HF should forward data to both the Indexers.

Then you should also have a Search Head to search data on the two indexers.

Then usually, to avoid a Single Point of Failure, it's better to have two HFs with a Load Balancer in front of them that manages load distribution andfail over

Ciao.

Giuseppe

Re: Which indexer should I send data to?

jmrubio — Fri, 09 Feb 2024 16:16:12 GMT

I have to work with what I have so it's going from the hf to the indexers. Thanks for the response @gcusello !!

Re: Which indexer should I send data to?

isoutamo — Fri, 09 Feb 2024 17:01:41 GMT

Hi
Even splunk can receive syslog feed you shouldn’t use it for that. With splunk you will lost more those events than using some real syslog server. On production use always HA syslog server instead of HF with syslog receiver.
r. Ismo