Getting Data In

App/Add-on

BRFZ
Communicator

Hello,

I have an architecture with a single SH and two indexers. I've installed the Splunk for Microsoft 365 add-on on the search head, so the collected logs are stored in the search head's index, but I want them to be stored on the indexers. Can you help me?

Thank you.

Labels (2)
0 Karma

BRFZ
Communicator

@PaulPanther Thank you for your response, and does it not have any impact given that the indexers are not in a cluster?

0 Karma

PaulPanther
Motivator

@BRFZ  If you have no cluster the data are not replicated. So if one indexer goes down your search couldn't access all data.

0 Karma

PaulPanther
Motivator

1. Create the neccessary indexes on your indexer

2. Configure Best practice: Forward search head data to the indexer layer - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...