Getting Data In

Heavy Forwarder as Indexer and License Usage

nryagin
Explorer

Hi colleagues,

I've still trying to find an answer to my questions here, but it seems there is nothing helpful to me.
We've got two Splunk Instances: the first one is a *Heavy Forwarder* and the second one is a Indexer and Seach Head.

To minimize workload on Seach Head I tried to turn on indexing ( indexAndForward) on HF and found that Splunk started using the licence twice faster than it was before. And just to clear understand I'd like to know does Splunk try to index data in the second time even if it already did it on HF? If yes why? and what could you propose? Thank you.

1 Solution

muebel
SplunkTrust
SplunkTrust

Hi nryagin, yeah, index and forward will do exactly that, in this case, indexes the events on the HF, and then sends it through its outputs to the indexer/sh, which also indexes it. If both splunk instances are using the same license, then this will be two instances of each event being indexed, which will then count towards your daily utilization.

To alleviate this, you could disable indexing on the search head, and set the HF up as your indexer, and remote search peer of the search head. This might not make total sense depending on the resource makeup of the HF box (splunk needs fast storage to be a good indexer, HFs are usually somewhat lightweight virtual machines).

Alternatively, you could just break out the indexer altogether, and have each role on a specific system, i.e. HF forwards to distinct indexer, and then SH searches remotely on the distinct indexer. More information on distributed search is here : https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Whatisdistributedsearch

Please let me know if this answers your question! 😄

View solution in original post

muebel
SplunkTrust
SplunkTrust

Hi nryagin, yeah, index and forward will do exactly that, in this case, indexes the events on the HF, and then sends it through its outputs to the indexer/sh, which also indexes it. If both splunk instances are using the same license, then this will be two instances of each event being indexed, which will then count towards your daily utilization.

To alleviate this, you could disable indexing on the search head, and set the HF up as your indexer, and remote search peer of the search head. This might not make total sense depending on the resource makeup of the HF box (splunk needs fast storage to be a good indexer, HFs are usually somewhat lightweight virtual machines).

Alternatively, you could just break out the indexer altogether, and have each role on a specific system, i.e. HF forwards to distinct indexer, and then SH searches remotely on the distinct indexer. More information on distributed search is here : https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Whatisdistributedsearch

Please let me know if this answers your question! 😄

nryagin
Explorer

Hi muebel,
Your comment is very useful for me. Thanks you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...