Getting Data In

Can a Splunk 6.3 heavy forwarder send data to a 6.1 indexer, and can I use index parallelization on the HF to forward this data?

Champion

Hi,

I have a multi-part question. First, can a 6.3 Heavy Forwarder sent to a 6.1 indexer? And second, can I use the index parallelization functionality on the 6.3 HFW to send this data? (Might be called serialization?). My scenario is that I have a layer of HFWs which collect syslog and tcp data from a load-balancer. I get a lot of traffic from these feeds. I was wondering if using 6.3 and enabling the multi-pipeline functionality would increase my throughput. (Or at the very least, allow me to take advantage of unused cycles on these vm's).

0 Karma
1 Solution

Champion

Ah, RTFB, my all time favorite. (Joking)...

Seriously though, I installed it, is there a way to validate the number of pipelines in use?

0 Karma

Builder

🙂 🙂 🙂 🙂

0 Karma

Champion

Found it - from splunkd.log:

11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 0.
11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 1.
11-16-2015 21:54:38.245 -0500 INFO PipelineComponent - Launching the pipelines for set 2.

0 Karma