Getting Data In

Heavy forwarder as cluster master

ryastrebov
Communicator

Hello splunkers!

It is possible to configure heavy forwarder as cluster master?
My heavy forvarder forward all data to peers, not indexing external data.

Best regards,
Roman

0 Karma
1 Solution

psow_splunk
Splunk Employee
Splunk Employee

The master is designed to function solely as the cluster manager. But I have no issues configuring it to monitor certain path and forwarding it to the indexers in the cluster. So it will still work

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Technically you can do this.

However, you need to understand the workload on the HF. If the HF starts to get overtaxed, there will be impact to your cluster in terms of maintaining SF and RF across all the indexers.

As long as you are aware of this, and keep your resources on the HF in check, this can be done. However, this is against Splunk best practices.

0 Karma

psow_splunk
Splunk Employee
Splunk Employee

The master is designed to function solely as the cluster manager. But I have no issues configuring it to monitor certain path and forwarding it to the indexers in the cluster. So it will still work

0 Karma

lguinn2
Legend

You should not use the heavy forwarder as a cluster master, although I suppose it is technically possible.

0 Karma

ryastrebov
Communicator

Why should not I do it?

0 Karma

lguinn2
Legend

According to the documentation: "The master has the sole function of managing the other cluster nodes."

Managing Indexers and Clusters of Indexers

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...