Multi site Data center forwarding data to indexer?

[aab5272]

Considering multi site data center for log forwarding having same logs , lets say site 1 and site 2 logs are being forwarded to indexer ,will this two copy will counted twice while indexing license if yes then what should be the approach to filter one copy of data before forwarding ?

[woodcock · Accepted solution]

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

[koshyk]

are you using Universal Forwarder to send these logs to Indexers? if yes, use autoLB and put names of all Indexers in the list to load balance, and the UF will work out where to send and it will send only one copy.

if you let me know which mechanism is used to send the data, we can answer. cheers

[aab5272]

Thanks for the response .
we are going to collect all the logs with syslog-ng and UF and sending it to intermediate forwarder which in turn would send data to indexer .