Getting Data In

How to forward events to a cluster environment?

riqbal
Communicator

Initially, I have a cluster environment( 3 indexes + 1 master node)

I want to configure my setup like below:

windows data source-----> Heavy forwarder------------------> [Index cluster]------------->SH-1

Currently, only index cluster is ready and forwarding & receiving is enabled on heavy forwarder.

I want to:

1- send windows logs to two indexers (indexer 1 and indexer 2) where should I configure this
on data source or on HF?

2- send windows data to a specific index.
So:
1. where should I create the index?
Can I create an index on any indexer and it will replicate automatically?

0 Karma
1 Solution

somesoni2
Revered Legend

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

View solution in original post

somesoni2
Revered Legend

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!