- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added a third Index to my Cluster Master How do I tell my forwarders to send data to the new index or how my forwarders know about the new index
thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
there are two way to do it
- manually in outputs.conf
- using indexer discovery with CM
and of course combination of those.
In most cases indexer discovery is the easiest way to manage this especially if you add and remove indexers or those ip/names change regularly. Here is instructions how to configure it https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/indexerdiscovery
If you are using manual method then just add the new one to same stanza in outputs.conf than old ones are. Based on your environment this can do with DS, other automation tool or manually.
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
there are two way to do it
- manually in outputs.conf
- using indexer discovery with CM
and of course combination of those.
In most cases indexer discovery is the easiest way to manage this especially if you add and remove indexers or those ip/names change regularly. Here is instructions how to configure it https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/indexerdiscovery
If you are using manual method then just add the new one to same stanza in outputs.conf than old ones are. Based on your environment this can do with DS, other automation tool or manually.
r. Ismo
