I could not find this answer anywhere. I want to ask for some advice installing the Fortinet FortiGate App for Splunk.
My set-up is:
1 search head.
1 Splunk master
My question is when configuring the Fortinet to forward its data to the indexers, what host will it be sending to?
My master indexer uses indexer discovery so when i install a new forwarder, i usually just point it to the master.
Can I do the same with the Fortinet FortiGate App for Splunk?
Or would it make more sense to create a data collection node and then forward the data to the indexers?
Indexer discovery works like this:
1. Peers report their receiving ports to master node
2. Forwarders poll master node to get the latest list of peer nodes
3. Forwarders send data to the peers in the list
4. A peer can be added or removed without affecting the forwarder configurations
Therefore, you can configure indexer discover on both the master node and forwarders, but forwarders still need to forward data to the indexers - it's just forwarders dynamically retrieve a list of indexers from the master node.
You install the Fortinet add-on on your forwarders and the add-on will automatically forward collected data to the indexers. Fortinet app must be installed on the search head because an app primarily contains search-time knowledge for dashboard reporting and visualizations.
For more information about where to install add-ons, please refer to documentation: