Getting Data In

How to forward _internal events to indexer, but keep them locally on deployment server?


I am working with the following architecture:

  • Search Head
  • Multiple Indexers
  • Deployment Server / License Master

We recently deployed a large number of forwarders and wanted to be able to allow other groups to see the deployment progress. Non-admin users don't have direct access to the Indexers or Deployment Server, so we are forwarding all of the internal events from the Deployment server to the indexers, so that we can create a dashboard to show how many devices for each serverclass or architecture have checked in. The deployment server is also designated as our License Master. The problem is that now the the "License Usage" page only goes back to the day that we enabled the event forwarding.

Is there any way to get the internal events forwarded on to the Indexers, but also keep them locally on the deployment server so we don't lose functionality from the License management?

1 Solution



You can set indexAndForward = true in outputs.conf:

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...