Getting Data In

Splunk indexers cluster


I have a lab setup with 1 SH, 1 Master node, 2 indexers peers.
My question is, which one of the indexers should act as the receiving server (from light forwarders).
Both of them?


Tags (2)
0 Karma

Ultra Champion

Both of them - no doubt ; -)

0 Karma


Yes. All forwarders should should have all indexers configured or use Indexer Discovery.

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!