Getting Data In

How to forward _internal events to indexer, but keep them locally on deployment server?

Explorer

I am working with the following architecture:

  • Search Head
  • Multiple Indexers
  • Deployment Server / License Master

We recently deployed a large number of forwarders and wanted to be able to allow other groups to see the deployment progress. Non-admin users don't have direct access to the Indexers or Deployment Server, so we are forwarding all of the internal events from the Deployment server to the indexers, so that we can create a dashboard to show how many devices for each serverclass or architecture have checked in. The deployment server is also designated as our License Master. The problem is that now the the "License Usage" page only goes back to the day that we enabled the event forwarding.

Is there any way to get the internal events forwarded on to the Indexers, but also keep them locally on the deployment server so we don't lose functionality from the License management?

1 Solution

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust