I am working with the following architecture:
- Search Head
- Multiple Indexers
- Deployment Server / License Master
We recently deployed a large number of forwarders and wanted to be able to allow other groups to see the deployment progress. Non-admin users don't have direct access to the Indexers or Deployment Server, so we are forwarding all of the internal events from the Deployment server to the indexers, so that we can create a dashboard to show how many devices for each serverclass or architecture have checked in. The deployment server is also designated as our License Master. The problem is that now the the "License Usage" page only goes back to the day that we enabled the event forwarding.
Is there any way to get the internal events forwarded on to the Indexers, but also keep them locally on the deployment server so we don't lose functionality from the License management?
