Heavy Forward

[vumanhtai]

hello Splunk Team
i want to config Heavy Forward to receive and index then send data to my cluster index?
Thank ALL

[gcusello · Accepted solution]

Hi vumanhtai,
to configure your Heavy Forwarder, you have to go in [Settings -- Forwarding and Receiving]
Then use [Forwardering Defaults] to say to locally index and forward.
Then use [Configure Forwarding] to say to the HF wht are the indexers to send logs.
Splunk will ask to restart itself.

Only one question: why do you want to locally index logs?
In this way you pay twice license and you don't need of local logs because you have the Indexers Cluster for searches.

Bye.
Giuseppe

[vumanhtai]

Thank You so much!
Can you give me your contact information?
I have run out of working hours and I want to contact you at another time.

[gcusello]

Continue to use the Community, in this way, your questions and answers will be useful also for other people and you can be helped also by other friends.

Bye.
Giuseppe

[vumanhtai]

Hi Gcusello
I see this message on my entire datamodel, how can I fix it?
"This object has no explicit index constraint. Consider adding one for better performance."