Indexing question on a heavy forwarder

[marvatwork]

I have a main indexer in one location (production) that gets inputs from all the systems located in that production location. I have a heavy-forwarder at another location (development) that gets inputs from all the systems at this second location. If I want to keep a local copy of the index at the developement site before forwarding it to the main indexer, do I need another license?

[kristian_kolb · Accepted solution]

They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.

Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.

/K

[lukejadamec]

No because it is not indexed twice. It is indexed once and then transferred.

[marvatwork]

That seems to work. My next question, is do I get hit twice for the data coming from the development site. For indexing it twice?