appのログがSeachHeaderに入ってしまう。（The app log goes into "SeachHeader".）

[mcdp_matsumoto]

Thank you for looking.
I would be grateful if you help me.

＝＝日本語＝＝
以下の構成のSplunkがあります。
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster/DeployMaster 1

「GitHub Addon」を「SeachHeader」にインストールしました。
githubからログを取得する設定を入れました。
なぜかログが「SeachHeader」に蓄積されてしまいます。
githubのログを「Indexer」に蓄積する方法はないでしょうか。

＝＝English＝＝
There is a Splunk with the following configuration.
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster / DeployMaster 1

Installed “GitHub Addon” on “SeachHeader”.
Added a setting to get logs from github.
For some reason logs are accumulated in "SeachHeader".
Is there any way to accumulate github logs in "Indexer"?

[richgalloway · Accepted solution]

Please verify the search head is forwarding its logs to the indexers.

[mcdp_matsumoto]

Thank you for response.
Please let me know the setting to send logs from "Seach Header" to indexer. The document cannot be found.

[richgalloway]

This is the first result from Google: https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/Forwardsearchheaddata

[mcdp_matsumoto]

thank you.
Solved the problem.