Getting Data In

I added a third Index to my Cluster Master How do I tell my forwarders to send data to the new index

ajromero
Path Finder

I added a third Index to my Cluster Master How do I tell my forwarders to send data to the new index or how my forwarders know about the new index

thank you

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

there are two way to do it

  1. manually in outputs.conf 
  2. using indexer discovery with CM

and of course combination of those.

In most cases indexer discovery is the easiest way to manage this especially if you add and remove indexers or those ip/names change regularly. Here is instructions how to configure it https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/indexerdiscovery 

If you are using manual method then just add the new one to same stanza in outputs.conf than old ones are. Based on your environment this can do with DS, other automation tool or manually.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

there are two way to do it

  1. manually in outputs.conf 
  2. using indexer discovery with CM

and of course combination of those.

In most cases indexer discovery is the easiest way to manage this especially if you add and remove indexers or those ip/names change regularly. Here is instructions how to configure it https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/indexerdiscovery 

If you are using manual method then just add the new one to same stanza in outputs.conf than old ones are. Based on your environment this can do with DS, other automation tool or manually.

r. Ismo

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...