Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Indexing question on a heavy forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a main indexer in one location (production) that gets inputs from all the systems located in that production location. I have a heavy-forwarder at another location (development) that gets inputs from all the systems at this second location. If I want to keep a local copy of the index at the developement site before forwarding it to the main indexer, do I need another license?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No because it is not indexed twice. It is indexed once and then transferred.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That seems to work. My next question, is do I get hit twice for the data coming from the development site. For indexing it twice?
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
