Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Indexing question on a heavy forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a main indexer in one location (production) that gets inputs from all the systems located in that production location. I have a heavy-forwarder at another location (development) that gets inputs from all the systems at this second location. If I want to keep a local copy of the index at the developement site before forwarding it to the main indexer, do I need another license?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No because it is not indexed twice. It is indexed once and then transferred.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That seems to work. My next question, is do I get hit twice for the data coming from the development site. For indexing it twice?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
