How to check whether splunk heavy forwarder is used only for forwarding not for indexeing the data ?

[Hemnaath]

Hi All, currently we are having two heavy forwarder instance which is mainly used to forward the syslog data to the indexer instances. But we could notice that one of the mount point in HF is getting rapidly full ? So we are confused whether the HF is indexing the data and forwarding to indexer instances. How and what configuration file we need to check to determine this behavior?

HF Version 6.4

thanks in advance

[sundareshr · Accepted solution]

By default it is forwardonly. To be sure, you add this setting to the output.conf on your HF

[indexAndForward]
index=false

The other check could be, look in index=_internal host=heavyforwarder, if you see events, bingo!!!!

[Hemnaath]

thanks for your input.