Getting Data In

If there is an outputs.conf on a dedicated search head, does it index anything?

msarro
Builder

This is a simple question I hope - exactly as stated, if there is an outputs.conf present on the search head, does it still perform local indexing, or does absolutely everything get forwarded to the indexers provided?

0 Karma

_d_
Splunk Employee
Splunk Employee

In your outputs.conf make sure you have a configuration similar to this (especially the first stanza):

[indexAndForward]
index = false

[tcpout]
defaultGroup = my-indexers

[tcpout:my-indexers]
server = indexer-1:9997, indexer-2:9997,...

bmacias84
Champion

That depends if you have the run splunk disable local-index. Prior to 5.0.2 _internal index was not forwarded only the _audit was. In later versions all indexes are forwarded if the outputs.conf is defined.

Additional Reading:
- Routeandfilterdatad

Hope this helps or gets you started.

0 Karma

grijhwani
Motivator

It indexes whatever is determined by your inputs, transforms, and outputs. If your inputs are not defined then there is nothing to index. If your outputs are expressly redirected to another indexer, then no.

The default condition, is yes. As a minimum by default it will be indexing the local Splunk internals (audit, access and so on).

0 Karma

yannK
Splunk Employee
Splunk Employee

No, a search-head is a regular splunk (indexer).

If you add forwarding or enable the "splunkforwarder" app it becomes what we call "heavy forwarder". ( parse locally, and that forward)
And may or may not also write locally if the indexandforward option is turned on (see the answer from d)

If you enable the "SplunkLightForwarderapp" then it becomes "light weight forwarder". (do not parse locally, and forward)But the **Web interface is automatically disabled*, and it's not very useful for a Search-head.

0 Karma

bmacias84
Champion

@yannk, I thought the default behavior was that of a light forwarder?

0 Karma

yannK
Splunk Employee
Splunk Employee

remark : a dedicated search-head with a forwarding configuration will likely act like a "heavy forwarder", it means that it will parse the data locally (and therefore needs the props.conf index time definition), then forward the cooked events to the indexers, those will write them to disk (without parsing them again).

0 Karma

msarro
Builder

So, in a distributed deployment where a dedicated search head needs to forward EVERYTHING to indexers, how do you disable any local indexing? So far the best explanation I have seen so far is to "create an outputs.conf file." I'm just trying to figure it out since I can't seem to find decent documentation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...