App/Add-on

[BRFZ]

Hello,

I have an architecture with a single SH and two indexers. I've installed the Splunk for Microsoft 365 add-on on the search head, so the collected logs are stored in the search head's index, but I want them to be stored on the indexers. Can you help me?

Thank you.

[BRFZ]

@PaulPanther Thank you for your response, and does it not have any impact given that the indexers are not in a cluster?

[PaulPanther]

@BRFZ  If you have no cluster the data are not replicated. So if one indexer goes down your search couldn't access all data.

[PaulPanther]

1. Create the neccessary indexes on your indexer

2. Configure Best practice: Forward search head data to the indexer layer - Splunk Documentation