Getting Data In
Highlighted

Do I need to redirect internal splunk events to index cluster FROM the cluster master?

Builder

Hello there! I do not have my internal events from my index cluster master in my index cluster. Do I need to configure an outputs.conf on it? Since I use indexer discovery, do I user localhost as a place to get the list of indexers?

I have assumed that being it is apart of the cluster it would redirect it's own logs to the cluster index layer.

0 Karma
Highlighted

Re: Do I need to redirect internal splunk events to index cluster FROM the cluster master?

Splunk Employee
Splunk Employee

Ultimately, the recommendation is you have all your splunk instances forward their logs to the indexer layer.

This means that you want the same outputs.conf on the search-heads, cluster-master, forwarders, license-masters, deployer... to sent to your indexers layer.
(but no need to have the indexers forwarding to themselves)
If you are using indexer discovery, the cluster-master should behave like the forwarders.

0 Karma
Highlighted

Re: Do I need to redirect internal splunk events to index cluster FROM the cluster master?

Builder

So then in outputs.conf i specify localhost when configuring index discovery?

0 Karma
Highlighted

Re: Do I need to redirect internal splunk events to index cluster FROM the cluster master?

Builder

You wrote "If you are using indexer discovery, the cluster-master should behave like the forwarders." What exactly does that mean? I am in fact using index discovery.

Thanks!

0 Karma