Forward data to indexer cluster

[RanjithaN99]

Hi,

I am working in a distributed Splunk environment with one search head and an indexer cluster.

I am trying to monitor a path that is on the search head and I created a monitor input from the web GUI.

How do I create an index on the indexer cluster and configure forwarding from the search head to the indexer cluster.

Please help me.

Thanks 

[gcusello]

Hi @RanjithaN99,

Indexer Cluster is managed by the Cluster Manager so you have to create the new indexes.conf in this server that deploys it to the indexers; for more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Aboutclusters

in few words, you have to create a stanza in indexes.conf with the new index using the CLI and push the configuration using GUI.

For data forwarding from te SH to the Indexers, you should already have this configuration because it's a best practice to send internal logs from all the Splunk servers to Indexers.

If not go in [Settings > Forwarding and Receiving > Forwarding] and configure Forwarding.

Ciao.

Giuseppe