how do you create a scalable splunk deployment of forwarders to specific index servers that report to a search head?

[HenryTaylor]

how do you create a scalable splunk deployment of forwarders to specific index servers that report to a search head?

[Runals]

I'd say use a deployment server and create multiple copies of outputs.conf as appropriate in your environment. At a high level a client checks into the deployment server, the appropriate outputs.conf package gets pushed, the forwarder restarts and starts sending logs to the right indexer(s). The kicker is to figure out how best to identify which hosts should get which outputs.conf. Can use things like hostnames, IP addresses, or what I like best to use is the clientName setting on the local forwarder agent. At any rate once you have those things in place new agents can come online and once they have checked into your deployment center it is all automagic.

The guts of how to do this are in the link martin posted but sometimes it is tough looking at documentation and thinking about it in terms of your environment.

[martin_mueller]

There's plenty of info here: http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Distributedoverview

If you have specific questions after that feel free to ask 🙂