All Apps and Add-ons

Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

Builder

Hello guys,

I've this configuration in a test environment :

1 SEARCH HEAD < (dist. search) > 1 INDEXER

(no clustered environment)

I set up indexes on the indexer then I still added those (dummy) indexes on the search head for management reasons.

The problem is with the Splunk Add-on for Java Management Extensions (JMX) : it's still writing on the local index of the search head! How to tell it to write on the indexer instead?

Thanks!

0 Karma

Legend

Hi realsplunk,
did you configured your Search Head to forward its logs to the Indexer?

  • [Settings -- Forward and Receiving]
  • Configure Forward -- New -- Indexer_IP:9997
  • Default Value for Forwarding
  • Splunk restart

After you can see to your Add-On to send logs the index you want.
Bye.
Giuseppe

Builder

Good idea, thanks!

However where are then stored internal indexes?

0 Karma

Splunk Employee
Splunk Employee

Hi @realsplunk - Did cusello's answer help solve your question? If yes, please don't forget to click "Accept" below his answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

0 Karma

Builder

Hi Aareneta, I couldn't try it yet. Thanks.

0 Karma

Legend

Hi realsplunk,
Splunk internal logs are stored in _internal index.
When Splunk doesn't find an index, it puts logs in index=main.
Every way, try this search
index=* sourcetype=yoursourcetype and verify if you have logs and in which index.
Bye.
Giuseppe