Getting Data In

Is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER?

tam82
Explorer

My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well

The first HF sends to other HF but is not indexed and the UF attached to HF1 is not showing up at all 

 

is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER 

Labels (1)
0 Karma

danielcj
Communicator

Hello,

To use a Heavy Forwarder as an intermediate tier, you should listen to the port that the data is being sent from the UF/HF (usually 9997) and configure the correct outputs to the Indexer tier. The first HF should also have the outputs configured to the second HF and the Indexer tier should listen to the inputs port (9997) too.

Also, the data is not indexed on the second HF, only on the Indexing tier the data is indexed.

 

Thanks.

 

0 Karma

tam82
Explorer

UF1sends to HF1 (listens on 9997) the forwards to HF2(listens on 9997) (this is where UF1 gets blocked)then sends to INDX1 (listens on 9997) 

 

UF2 goes directly to HF2 - Index1 This works fine 

0 Karma

gcusello
Legend

Hi @tam82,

as @danielcj said, you can use an HF as a concentrator and this is the usual approach using Splunk Cloud or having restricted networks.

In this case you have to enable ports (usually 9997)  and you can use it both for UFs and HFs.

The only thing that you have to remember adding an HF as data source is that HF cooks data, so if you have some transformation or filter on your intermediate HF, you have to copy them also on the new HF, because usually HFs send already cooked logs.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Maybe one nice to know fact is, that when you are replacing UF with HF, then you start to generate more traffic  between those hosts, as HF add more metadata to all events. Basically if you don't need to do any data manipulation (like transforms) on intermediate forwarder it's better to use UF instead of HF. Just increase UF's throughput with limits.conf if the normal 256K is not enough.

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...