Getting Data In

How to forward events to a cluster environment?

Communicator

Initially, I have a cluster environment( 3 indexes + 1 master node)

I want to configure my setup like below:

windows data source-----> Heavy forwarder------------------> [Index cluster]------------->SH-1

Currently, only index cluster is ready and forwarding & receiving is enabled on heavy forwarder.

I want to:

1- send windows logs to two indexers (indexer 1 and indexer 2) where should I configure this
on data source or on HF?

2- send windows data to a specific index.
So:
1. where should I create the index?
Can I create an index on any indexer and it will replicate automatically?

0 Karma
1 Solution

Revered Legend

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

View solution in original post

Revered Legend

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!