Heavy Forwarder as Indexer and License Usage

[nryagin]

Hi colleagues,

I've still trying to find an answer to my questions here, but it seems there is nothing helpful to me.
We've got two Splunk Instances: the first one is a *Heavy Forwarder* and the second one is a Indexer and Seach Head.

To minimize workload on Seach Head I tried to turn on indexing ( indexAndForward) on HF and found that Splunk started using the licence twice faster than it was before. And just to clear understand I'd like to know does Splunk try to index data in the second time even if it already did it on HF? If yes why? and what could you propose? Thank you.

[muebel · Accepted solution]

Hi nryagin, yeah, index and forward will do exactly that, in this case, indexes the events on the HF, and then sends it through its outputs to the indexer/sh, which also indexes it. If both splunk instances are using the same license, then this will be two instances of each event being indexed, which will then count towards your daily utilization.

To alleviate this, you could disable indexing on the search head, and set the HF up as your indexer, and remote search peer of the search head. This might not make total sense depending on the resource makeup of the HF box (splunk needs fast storage to be a good indexer, HFs are usually somewhat lightweight virtual machines).

Alternatively, you could just break out the indexer altogether, and have each role on a specific system, i.e. HF forwards to distinct indexer, and then SH searches remotely on the distinct indexer. More information on distributed search is here : https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Whatisdistributedsearch

Please let me know if this answers your question! 😄

[nryagin]

Hi muebel,
Your comment is very useful for me. Thanks you.