Distributed Summary Indexing from Search Head

[mattcg]

Hello,

I'm looking to set up our search head to send summary index data it generates back to our indexers in a distributed environment.

I found the following question, and I understand the theory of the answer. However, I don't know specifically how to set up the search head as a forwarder and how to tell it to forward the summaries generated instead of indexing them.

http://answers.splunk.com/questions/5837/summary-indexing-on-a-search-head

Furthermore, is Splunk intelligent enough to determine that summaries generated by a search head and then forwarded back down to our indexers are summaries and therefore not count them toward our license?

Thanks for any guidance.

[sabaKhadivi]

I did it and internal,audit , introspection also copied to indexer, how can I change configuration in the way it exclude internal indexes

[Brian_Osburn · Accepted solution]

Hi Matt - Having gone through this before, I can say that anything forwarded from the Search head to the indexers is NOT counted toward your license cost. You can even set up the Search head to use the forwarder license included with the app.

With regards to setting up the Search head as a forwarder, it's the same process as you would use for any other forwarder. You can find the details here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving#Set_up_forward....

Now, there's one caveat. If you use custom named summary indexes, you'll have to make sure they're created in the indexes.conf on the Indexers as well.

Hope this helps! Brian

[Splunk_U]

I have also tried the same. I have a srch head and two indexers. I tried to forward the summary index from the srch head to both the indexers. Now for one of the Indxers it is working fine but for the other one it is not working.

[Jason]

Not everything forwarded from a SH to an indexer is license free - only things that are license-free anyways, such as internal logs and summary indexing. It is possible to bust a forwarder license with something like the UNIX app inputs and no indexer to forward to!

[mattcg]

Excellent. That's exactly what I was looking for, and I forgot to mention that we do use custom named summary indexes. I will try the setup as you suggest and report back. Thanks!