All Apps and Add-ons

Running the Splunk App for AWS in a tiered environment, why does it only list indexes available locally on the heavy forwarder, not the indexers?

nehtasplunk
New Member

Hi folks.

We are attempting to configure the Splunk App for AWS.
The documentation for the app recommends running it on a Heavy Forwarder, but we are unsure how to get captured events stored in the indexers (As opposed to a local index on the HF itself).

We have 2 x clustered HFs, forwarding to 2 x clustered Indexers.
The Splunk App for AWS in installed on the first HF. (documentation says it should be installed on only one HF).
The HFs are a minimal configuration (designed to be torn down and rebuilt as needed) so we want to avoid save the events locally to the HF.

How do we get the the AWS events captured by the App on the HF to be stored in the indexes residing on the Indexers?
Note: As per the doco we have installed the AWS app on the HF, but when configuring the app, it only lists indexes that are available locally on the HF, not the indexers. (which to me indicates it would store the events locally on the HF).

Also, we have configured the AWS App on the HF so the config interface can be configured from the SearchHead (if this helps).

The version of Splunk App for AWS we are using is v4.2.1

Thanks.

0 Karma

goodsellt
Contributor

Since the app queries the local index store, you'll have to include an indexes.conf file on those HFs with your actual indexes (you should be able to leave all the settings blank) so it knows they exist. A way to be extra safe about this is to explicitly disable IndexAndForward in your HF configurations (even though it is false by default).

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...