It indexes whatever is determined by your inputs, transforms, and outputs. If your inputs are not defined then there is nothing to index. If your outputs are expressly redirected to another indexer, then no.
The default condition, is yes. As a minimum by default it will be indexing the local Splunk internals (audit, access and so on).
So, in a distributed deployment where a dedicated search head needs to forward EVERYTHING to indexers, how do you disable any local indexing? So far the best explanation I have seen so far is to "create an outputs.conf file." I'm just trying to figure it out since I can't seem to find decent documentation.
remark : a dedicated search-head with a forwarding configuration will likely act like a "heavy forwarder", it means that it will parse the data locally (and therefore needs the props.conf index time definition), then forward the cooked events to the indexers, those will write them to disk (without parsing them again).
No, a search-head is a regular splunk (indexer).
If you add forwarding or enable the "splunkforwarder" app it becomes what we call "heavy forwarder". ( parse locally, and that forward)
And may or may not also write locally if the indexandforward option is turned on (see the answer from d)
If you enable the "SplunkLightForwarderapp" then it becomes "light weight forwarder". (do not parse locally, and forward)But the **Web interface is automatically disabled*, and it's not very useful for a Search-head.
That depends if you have the run splunk disable local-index. Prior to 5.0.2 _internal index was not forwarded only the _audit was. In later versions all indexes are forwarded if the outputs.conf is defined.
Hope this helps or gets you started.
In your outputs.conf make sure you have a configuration similar to this (especially the first stanza):
index = false
defaultGroup = my-indexers
server = indexer-1:9997, indexer-2:9997,...