How to forward events to a cluster environment?

[riqbal]

Initially, I have a cluster environment( 3 indexes + 1 master node)

I want to configure my setup like below:

windows data source-----> Heavy forwarder------------------> [Index cluster]------------->SH-1

Currently, only index cluster is ready and forwarding & receiving is enabled on heavy forwarder.

I want to:

1- send windows logs to two indexers (indexer 1 and indexer 2) where should I configure this
on data source or on HF?

2- send windows data to a specific index.
So:
1. where should I create the index?
Can I create an index on any indexer and it will replicate automatically?

[somesoni2 · Accepted solution]

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment