All Apps and Add-ons

appのログがSeachHeaderに入ってしまう。(The app log goes into "SeachHeader".)

New Member

Thank you for looking.
I would be grateful if you help me.

==日本語==
以下の構成のSplunkがあります。
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster/DeployMaster 1

「GitHub Addon」を「SeachHeader」にインストールしました。
githubからログを取得する設定を入れました。
なぜかログが「SeachHeader」に蓄積されてしまいます。
githubのログを「Indexer」に蓄積する方法はないでしょうか。

==English==
There is a Splunk with the following configuration.
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster / DeployMaster 1

Installed “GitHub Addon” on “SeachHeader”.
Added a setting to get logs from github.
For some reason logs are accumulated in "SeachHeader".
Is there any way to accumulate github logs in "Indexer"?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Please verify the search head is forwarding its logs to the indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Please verify the search head is forwarding its logs to the indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thank you for response.
Please let me know the setting to send logs from "Seach Header" to indexer. The document cannot be found.

0 Karma

SplunkTrust
SplunkTrust

This is the first result from Google: https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/Forwardsearchheaddata

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

thank you.
Solved the problem.

0 Karma