Do I need to redirect internal splunk events to index cluster FROM the cluster master?

[brent_weaver]

Hello there! I do not have my internal events from my index cluster master in my index cluster. Do I need to configure an outputs.conf on it? Since I use indexer discovery, do I user localhost as a place to get the list of indexers?

I have assumed that being it is apart of the cluster it would redirect it's own logs to the cluster index layer.

[yannK]

Ultimately, the recommendation is you have all your splunk instances forward their logs to the indexer layer.

This means that you want the same outputs.conf on the search-heads, cluster-master, forwarders, license-masters, deployer... to sent to your indexers layer.
(but no need to have the indexers forwarding to themselves)
If you are using indexer discovery, the cluster-master should behave like the forwarders.

[brent_weaver]

You wrote "If you are using indexer discovery, the cluster-master should behave like the forwarders." What exactly does that mean? I am in fact using index discovery.

Thanks!

[brent_weaver]

So then in outputs.conf i specify localhost when configuring index discovery?