Getting Data In

Ingesting data into two indexes from one Heavy Forwarder

Loves-to-Learn Everything

I have Splunk in the below design

One HF to two sperate indexers that are not clustered. 

I have UF installed on my workstation and UF is sending logs to the HF.

HF has data inputs set to all types of windows logs to an index to windows and this is going to indexer A but data not going to indexer B.

My outputs.conf in the UF is like

useACK = true
maxQueueSize = auto
readTimeout = 300

server =
compressed = TRUE
sslRootCAPath = C:/Program Files/SplunkUniversalForwarder/etc/apps/test
sslCertPath = C:/Program Files/SplunkUniversalForwarder/etc/apps/test
sslPassword = Password
sslVerifyServerCert = true
sslCommonNameToCheck =

In the indexer A I can see the data is ingested but in the indexer B I cannot see the data.

As I mentioned earlier indexer A and indexer B are not clustered indexers.

0 Karma


Hi @splunky1,

each Heavy Forwarder (don't ask me why because I never understood this!) sends logs to only one Indexer even if it has two Indexers available: it can change the destination Indexer, but always one at a time.

If you can is more efficient to use the Heavy Forwarder as a concentrator only if you have strickly security requirements, in other words, if you can is more efficient that UFs send their logs directly to the Indexers and use HF only for syslogs.

In addition if you have only one HF you have an additional Single Point of failure



0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...