We have indexer cluster setup. We are trying to use the REST API on the Heavy Forwarder to receive data update. But i am not sure if creating index on the HF is required to make sure indexer gets the data.
I do see an earlier posting is similar to this one. Since it's an old posting, i just want to confirm If using REST API on the HF, while output.conf can point to the indexer/cluster would work, with no index stored on the HF.
I think i've gone on a tangent. All I wanted to know is for REST API, it's pushing data to this URI.
If no index is required on the HF, then it will be sent to the indexer directly.
Is that correct?
it might be one or another app contain indexes.conf
if you do a find on all apps with indexes.conf or a btool then it shows which app have created it incorrectly
/opt/splunk/bin/splunk cmd btool indexes list --debug > /tmp/indexes.btool
in your HF
ok, I was able to find on the HF at this location for the indexes.conf.
And I've found the index in that indexes.conf file.
coldPath = $SPLUNKDB/myindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNKDB/myindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/myindex/thaweddb
I did look at my HF.
There is no entry in the indexes.conf at this location /opt/splunk/etc/system/default.
Here is outputs.conf in /opt/splunk/etc/system/local
defaultGroup = default-autolb-group
indexAndForward = 1
server = xx.xx.xx.xx:9997