Getting Data In

Heavy Forwarder as Indexer and License Usage

nryagin
Explorer

Hi colleagues,

I've still trying to find an answer to my questions here, but it seems there is nothing helpful to me.
We've got two Splunk Instances: the first one is a *Heavy Forwarder* and the second one is a Indexer and Seach Head.

To minimize workload on Seach Head I tried to turn on indexing ( indexAndForward) on HF and found that Splunk started using the licence twice faster than it was before. And just to clear understand I'd like to know does Splunk try to index data in the second time even if it already did it on HF? If yes why? and what could you propose? Thank you.

1 Solution

muebel
SplunkTrust
SplunkTrust

Hi nryagin, yeah, index and forward will do exactly that, in this case, indexes the events on the HF, and then sends it through its outputs to the indexer/sh, which also indexes it. If both splunk instances are using the same license, then this will be two instances of each event being indexed, which will then count towards your daily utilization.

To alleviate this, you could disable indexing on the search head, and set the HF up as your indexer, and remote search peer of the search head. This might not make total sense depending on the resource makeup of the HF box (splunk needs fast storage to be a good indexer, HFs are usually somewhat lightweight virtual machines).

Alternatively, you could just break out the indexer altogether, and have each role on a specific system, i.e. HF forwards to distinct indexer, and then SH searches remotely on the distinct indexer. More information on distributed search is here : https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Whatisdistributedsearch

Please let me know if this answers your question! 😄

View solution in original post

muebel
SplunkTrust
SplunkTrust

Hi nryagin, yeah, index and forward will do exactly that, in this case, indexes the events on the HF, and then sends it through its outputs to the indexer/sh, which also indexes it. If both splunk instances are using the same license, then this will be two instances of each event being indexed, which will then count towards your daily utilization.

To alleviate this, you could disable indexing on the search head, and set the HF up as your indexer, and remote search peer of the search head. This might not make total sense depending on the resource makeup of the HF box (splunk needs fast storage to be a good indexer, HFs are usually somewhat lightweight virtual machines).

Alternatively, you could just break out the indexer altogether, and have each role on a specific system, i.e. HF forwards to distinct indexer, and then SH searches remotely on the distinct indexer. More information on distributed search is here : https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Whatisdistributedsearch

Please let me know if this answers your question! 😄

View solution in original post

nryagin
Explorer

Hi muebel,
Your comment is very useful for me. Thanks you.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!