Question on indexing

[hrithiktej]

We have 2 linux boxes that serve as indexers plus our syslog servers, there is no fowarder in picture since we have syslog and indexer on the same box. I was wondering how does the indexing happen without the forwarder how is indexer picking up logs from syslog folder.

[gjanders · Accepted solution]

A Splunk indexer is a Splunk enterprise installation and can therefore have an inputs.conf.

An indexer's primary purpose is to index data, but it can also read data from it's own filesystem for indexing (it does this for internal logs by default, in the case you mentioned it is likely reading from the syslog directories).

However if you have an indexer cluster you might want to have a forwarder (on a separate machine) to receive syslog data and then send the data down to the indexer cluster to ensure the data is evenly spread over the cluster members.

[hrithiktej]

Thanks I figured out remote logs are received via syslog and then written to a local file on the indexers and monitored locally in our case. And we do have a f5 load balancer before the indexer cluster