Heavy forwarder as cluster master

[ryastrebov]

Hello splunkers!

It is possible to configure heavy forwarder as cluster master?
My heavy forvarder forward all data to peers, not indexing external data.

Best regards,
Roman

[esix_splunk]

Technically you can do this.

However, you need to understand the workload on the HF. If the HF starts to get overtaxed, there will be impact to your cluster in terms of maintaining SF and RF across all the indexers.

As long as you are aware of this, and keep your resources on the HF in check, this can be done. However, this is against Splunk best practices.

[psow_splunk · Accepted solution]

The master is designed to function solely as the cluster manager. But I have no issues configuring it to monitor certain path and forwarding it to the indexers in the cluster. So it will still work

[lguinn2]

You should not use the heavy forwarder as a cluster master, although I suppose it is technically possible.

[ryastrebov]

Why should not I do it?

[lguinn2]

According to the documentation: "The master has the sole function of managing the other cluster nodes."

Managing Indexers and Clusters of Indexers