What is the best way to index data from a distributed location

[mctester]

I need to add a new data input from a mount, but I have a distributed architecture (one forwarder / search head and two indexers). Should the mount go to the search head / forwarder or to both indexes?

What is the recommended solution for this?

[hexx · Accepted solution]

One of the goals of a distributed architecture such as yours is to separate data input (performed by the forwarder) from the indexing and searching activities (performed by the indexer).

I would recommend to mount the filesystem that holds the files you want as input on your forwarder, and configure a [monitor] stanza in inputs.conf to monitor those directories.

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories#Monitor_syntax_and_...

On a different topic, you may want to host your search head on a different server than your forwarder so that if your forwarder goes down you would still be able to search your indexed data.