Data not forwarded to Indexer without a local index

[mnaim]

I'm currently sending REST API Modular Input data to a Heavy Forwarder, which is supposed to forward the data to the Indexer. Data is forwarded to the Indexer only when I index it on the Heavy Forwarder first. I don't want to index on the forwarder. I just want the data to get forwarded to the Indexer.

Any idea what could be the issue?

Thank you,

[yannK · Accepted solution]

While you can create inputs on the inputs.conf or any index you want.
You cannot create an input using CLI/REST without the index destination being defined locally (It is because of a test check that is not relevant to the forwarders.).

This is fixed in splunk 6.*
Otherwise for splunk 5 or 4, the workaround is to use the configuration file, or define the index first (event if events are forwarded not indexed locally) see http://answers.splunk.com//answers/104473/forwarding-events-to-custom-index-on-cluster-peers

[mnaim]

Thank you!