Do forwarders require indexes.conf?

[jaoui]

If i am setting up a heavy forwarder to monitor directories and tag indexes, do i need to create an indexes.conf on it or is specifying an index in inputs.conf sufficient?

[jaoui · Accepted solution]

I learned that Splunk Forwarders do not necessarily need indexes.conf to tag inputs for a given index but there are 3 different scenarios:

1. When using the configuration files there is no restriction and Splunk will forward correctly without the indexes.conf
2. When using the CLI, splunk will complain if we try to configure inputs without a corresponding entry in indexes.conf
3. When using the web, we will only be presented with indexes configured in indexes.conf

Hope that helps others!

[rroberts]

If you're going to go with the defaults you do not need to setup a $SPLUNK_HOME/etc/system/local/indexes.conf. You can go with the default out-of-the-box $SPLUNK_HOME/etc/system/default/indexes.conf. You also dont need to specify an index in inputs.conf if you want to write to the default main index.

[MuS]

Hi jaoui, no you don't need it on the forwarder

[jaoui]

i am planning out like 10 indexes on the inputs of this heavy forwarder (it will be monitoring directories written to by syslog-ng)

if i specify the indexes in inputs.conf like:
[monitor:///data/syslog-ng/cisco]
host_segment = 4
index = net_cisco
sourcetype = cisco_syslog

do i need a corresponding entry in indexes.conf on the forwarder for net_cisco? even though the forwarder is not itself indexing data?