Splunk Add-on for Java Management Extensions: How to configure the add-on to write to the indexer instead of the search head?

[realsplunk]

Hello guys,

I've this configuration in a test environment :

1 SEARCH HEAD < (dist. search) > 1 INDEXER

(no clustered environment)

I set up indexes on the indexer then I still added those (dummy) indexes on the search head for management reasons.

The problem is with the Splunk Add-on for Java Management Extensions (JMX) : it's still writing on the local index of the search head! How to tell it to write on the indexer instead?

Thanks!

[gcusello]

Hi realsplunk,
did you configured your Search Head to forward its logs to the Indexer?

• [Settings -- Forward and Receiving]
• Configure Forward -- New -- Indexer_IP:9997
• Default Value for Forwarding
• Splunk restart

After you can see to your Add-On to send logs the index you want.
Bye.
Giuseppe

[realsplunk]

Good idea, thanks!

However where are then stored internal indexes?

[aaraneta_splunk]

Hi @realsplunk - Did cusello's answer help solve your question? If yes, please don't forget to click "Accept" below his answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

[realsplunk]

Hi Aareneta, I couldn't try it yet. Thanks.

[gcusello]

Hi realsplunk,
Splunk internal logs are stored in _internal index.
When Splunk doesn't find an index, it puts logs in index=main.
Every way, try this search
index=* sourcetype=yoursourcetype and verify if you have logs and in which index.
Bye.
Giuseppe