Getting Data In

Heavy Forward

Path Finder

hello Splunk Team
i want to config Heavy Forward to receive and index then send data to my cluster index?
Thank ALL

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi vumanhtai,
to configure your Heavy Forwarder, you have to go in [Settings -- Forwarding and Receiving]
Then use [Forwardering Defaults] to say to locally index and forward.
Then use [Configure Forwarding] to say to the HF wht are the indexers to send logs.
Splunk will ask to restart itself.

Only one question: why do you want to locally index logs?
In this way you pay twice license and you don't need of local logs because you have the Indexers Cluster for searches.

Bye.
Giuseppe

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi vumanhtai,
to configure your Heavy Forwarder, you have to go in [Settings -- Forwarding and Receiving]
Then use [Forwardering Defaults] to say to locally index and forward.
Then use [Configure Forwarding] to say to the HF wht are the indexers to send logs.
Splunk will ask to restart itself.

Only one question: why do you want to locally index logs?
In this way you pay twice license and you don't need of local logs because you have the Indexers Cluster for searches.

Bye.
Giuseppe

View solution in original post

0 Karma

Path Finder

Thank You so much!
Can you give me your contact information?
I have run out of working hours and I want to contact you at another time.

0 Karma

SplunkTrust
SplunkTrust

Continue to use the Community, in this way, your questions and answers will be useful also for other people and you can be helped also by other friends.

Bye.
Giuseppe

0 Karma

Path Finder

Hi Gcusello
I see this message on my entire datamodel, how can I fix it?
"This object has no explicit index constraint. Consider adding one for better performance."

0 Karma