All Apps and Add-ons

Running the Splunk App for AWS in a tiered environment, why does it only list indexes available locally on the heavy forwarder, not the indexers?

nehtasplunk
New Member

Hi folks.

We are attempting to configure the Splunk App for AWS.
The documentation for the app recommends running it on a Heavy Forwarder, but we are unsure how to get captured events stored in the indexers (As opposed to a local index on the HF itself).

We have 2 x clustered HFs, forwarding to 2 x clustered Indexers.
The Splunk App for AWS in installed on the first HF. (documentation says it should be installed on only one HF).
The HFs are a minimal configuration (designed to be torn down and rebuilt as needed) so we want to avoid save the events locally to the HF.

How do we get the the AWS events captured by the App on the HF to be stored in the indexes residing on the Indexers?
Note: As per the doco we have installed the AWS app on the HF, but when configuring the app, it only lists indexes that are available locally on the HF, not the indexers. (which to me indicates it would store the events locally on the HF).

Also, we have configured the AWS App on the HF so the config interface can be configured from the SearchHead (if this helps).

The version of Splunk App for AWS we are using is v4.2.1

Thanks.

0 Karma

goodsellt
Contributor

Since the app queries the local index store, you'll have to include an indexes.conf file on those HFs with your actual indexes (you should be able to leave all the settings blank) so it knows they exist. A way to be extra safe about this is to explicitly disable IndexAndForward in your HF configurations (even though it is false by default).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...