Cluster Master and Forwarding?

[gschmitz]

Hi,
I set up a couple of inputs on my cluster master and I do see it collecting data in the logs.
However even after activating Heavy and Light Forwarder modes as per the wiki (http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Forwardercapabilities) I don't even see it trying to connect to the indexers (i.e. its slaves)?
Am I doing something wrong? Do I have to deploy a universal forwarder next to the master in order to monitor it?

[nromito_splunk]

Since the master is supposed to solely control the activities of the index cluster, it is recommended that you don't add extra work for the master to do. If you absolutely need to monitor these few files on the cluster master, I would recommend following this documentation (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Forwardmasterdata).

It is best practice to forward all of the master's logs to the peers, so the master does not have to be bogged down with any indexing itself.

[psow_splunk]

The master is designed to function solely as the cluster manager. But I have no issues configuring it to monitor certain path and forwarding it to the indexers in the cluster. So it will still work

[Steve_G_]

The master is designed to function solely as the cluster manager. It's not a good idea to ask it to index external data; that's the job of the peer nodes.

The master will index its own internal data, of course, which you can access directly on the master. The master dashboard should handle most of your monitoring needs. I suppose you could configure an outputs.conf file on the master to forward that data to some other instance, if necessary, but don't set the master up as a heavy or light forwarder.

[gschmitz]

In fact enabling these apps switches off replication. Will continue at a later point in time to investigate this. If somebody has a working configuration for this, you are very much invited to post it though!