Getting Data In

What is the best way to index data from a distributed location

Communicator

I need to add a new data input from a mount, but I have a distributed architecture (one forwarder / search head and two indexers). Should the mount go to the search head / forwarder or to both indexes?

What is the recommended solution for this?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

One of the goals of a distributed architecture such as yours is to separate data input (performed by the forwarder) from the indexing and searching activities (performed by the indexer).

I would recommend to mount the filesystem that holds the files you want as input on your forwarder, and configure a [monitor] stanza in inputs.conf to monitor those directories.

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories#Monitor_syntax_and_...

On a different topic, you may want to host your search head on a different server than your forwarder so that if your forwarder goes down you would still be able to search your indexed data.

View solution in original post

Splunk Employee
Splunk Employee

One of the goals of a distributed architecture such as yours is to separate data input (performed by the forwarder) from the indexing and searching activities (performed by the indexer).

I would recommend to mount the filesystem that holds the files you want as input on your forwarder, and configure a [monitor] stanza in inputs.conf to monitor those directories.

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories#Monitor_syntax_and_...

On a different topic, you may want to host your search head on a different server than your forwarder so that if your forwarder goes down you would still be able to search your indexed data.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!