Can a Splunk 6.3 heavy forwarder send data to a 6.1 indexer, and can I use index parallelization on the HF to forward this data?

[a212830]

Hi,

I have a multi-part question. First, can a 6.3 Heavy Forwarder sent to a 6.1 indexer? And second, can I use the index parallelization functionality on the 6.3 HFW to send this data? (Might be called serialization?). My scenario is that I have a layer of HFWs which collect syslog and tcp data from a load-balancer. I get a lot of traffic from these feeds. I was wondering if using 6.3 and enabling the multi-pipeline functionality would increase my throughput. (Or at the very least, allow me to take advantage of unused cycles on these vm's).

[asimagu · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Compatibilitybetweenforwardersandindexe...

[a212830]

Ah, RTFB, my all time favorite. (Joking)...

Seriously though, I installed it, is there a way to validate the number of pipelines in use?

[asimagu]

🙂 🙂 🙂 🙂

[a212830]

Found it - from splunkd.log:

11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 0.
11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 1.
11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 2.