- Data Flow:
Data goes DIRECTLY from UF to indexers on port 9997 (not to cluster manager)
Cluster Manager only handles configuration distribution
- Configuration Management:
Props and transforms configs are deployed via cluster manager
These configs are pushed to index peers via index cluster bundle
- Processing Location:
All parsing happens on the indexers (index peers)
Each indexer applies the deployed configurations independently
For Deep Understanding: Refer: https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platfor...
- Review props.conf documentation: docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Propsconf
- docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf
Since there are many pipeline components, I encourage you to read through these resources for a complete understanding.
Simple Data Flow here.
If this Helps, Please Upvote.
@Karthikeya Index peers are simply indexers that work together in a Splunk cluster environment. They are responsible for receiving, processing, and storing data while maintaining copies across multiple indexers for redundancy and high availability. When a Cluster Master pushes configuration changes through an index cluster bundle, all index peers receive the same settings to ensure consistent operation across the cluster.
Refer: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Basicclusterarchitecture
https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Howclusteredindexingworks
If this Helps, Please Upvote and Mark as solved.
