How should I configure a Heavy Forwarder outputs.conf to work with the distributed management console?

[BlueSocket]

Dear All,

I have been getting ready to set up Distributed Management Console after our upgrade to Splunk 6.3.2 and I am working through the pre-requisites document. We have a distributed environment with one search head, two clustered indexers, a Deployment Server/Cluster Master and a Heavy Forwarder.

When I look at the _internal index from the Search Head, I see data from all of the hosts except for the Heavy Forwarder. I think that I should get data from the Heavy Forwarder as well, so that I can monitor it from the DMC, however, it does not say this.

When looking at the HF outputs.conf, I see:

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
disabled = false
server = indexer02:9997,indexer01:9997

[tcpout-server://indexer01:9997]

[tcpout-server://indexer02:9997]

Should I change this config file to include the following setting in the tcpout stanza, or will this break the Heavy Forwarder?

[tcpout]
forwardedindex.filter.disable = true  

I am not indexing any data on the HF - it is being used to forward syslog data, mainly.

Kindest regards,

BlueSocket

[lguinn2 · Accepted solution]

I think you need to add a bit more to your outputs.conf.

In fact, just follow the instructions here: Best practice: Forward search head data to the indexer layer
These instructions are correct, because the heavy forwarder is really just like a search head in some ways: neither of them should be indexing anything. And although you think that you aren't indexing anything on your heavy forwarder, you might be... Since the internal indexes don't require a license, so you might well be indexing without realizing it.