Getting Data In

Add Remote Index to Heavy Forwarder

caviman2201
Path Finder

I have several heavy forwarders in my environment and when I configure data inputs on them, to get the forwarder to send the events to my indexer and put them in a specific index, I have to use inputs.conf. Is there any way to add the indexes on my indexer to the available indexes in the drop-down menu on the web interface of the heavy forwarder?

0 Karma

lguinn2
Legend

No, there is not. The drop-down is populated based on the actual indexes that exist on the local machine (ie, the contents of $SPLUNK_HOME/var/lib/splunk.) I don't think it would be a good idea to create those indexes locally...

0 Karma

caviman2201
Path Finder

So there's really no point to a Heavy Forwarder then over a Light Forwarder if I have to do almost everything in the text files anyway... The problem I'm running into is that I want to be able to use the GUI's text file preview/source type creation wizard AND have the forwarder send the events to my indexer as opposed to indexing them locally...

Are you saying that isn't possible?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...