Deployment Architecture

Is it normal to see splunk-optimize running on a splunk forwarder instance?

Mick
Splunk Employee
Splunk Employee

I can see why it runs on my forwarders that are also indexing data, but why is it running on my LightWeightForwarder instances? They aren't indexing any data.

1 Solution

Mick
Splunk Employee
Splunk Employee

Yes this is completely normal. Although the LightWEightForwarder may not be indexing any of your data, it does use the index structure to keep track of the files it is monitoring and forwarding to your indexer

View solution in original post

Arseny
New Member

Guys, I suppose this process is running to optimize Splunk service database called fishbucket. Don't you think so? This database is used by splunk even when LWF is enabled. Is there anybody from Splunk support or Splunk guru's to prove this statement?
However this version is the same as the answer above I suppose, I've just pointed to a concrete database name.

0 Karma

Mick
Splunk Employee
Splunk Employee

Yes this is completely normal. Although the LightWEightForwarder may not be indexing any of your data, it does use the index structure to keep track of the files it is monitoring and forwarding to your indexer

jrodman
Splunk Employee
Splunk Employee

In 4.0? I don't think there are any indexes.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...