Getting Data In

Which index does the forwarded data go???

Path Finder

How do I know which index forwarded data goes to receiver instance ? I'm not sure about that, but i've created 2 index. One on the forwarder other on the receiver instance and here is the trick, both with the same name and I guess it might be working because the index on the receiver is increasing.

how can i make sure about that ??? and is there any way to set this up if is not correct ??

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

You don't need to create indexes on forwarder nodes. Indexes only need to be created at the indexer. A forwarder can influence which index forwarded data goes into at the indexer via inputs.conf, similar to as follows:

[monitor:///my/log/file.txt]
index=myindex

But, this index must exist at the indexer, or the data will fall into /dev/null

Typically the light forwarder configuration disables all local indexes, through $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/indexes.conf.

View solution in original post

SplunkTrust
SplunkTrust

You don't need to create indexes on forwarder nodes. Indexes only need to be created at the indexer. A forwarder can influence which index forwarded data goes into at the indexer via inputs.conf, similar to as follows:

[monitor:///my/log/file.txt]
index=myindex

But, this index must exist at the indexer, or the data will fall into /dev/null

Typically the light forwarder configuration disables all local indexes, through $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/indexes.conf.

View solution in original post

Path Finder

I'm sorry for my ignorance dwaddle, but where can I find this file ??
Thank you very much

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!