Getting Data In

Why did our heavy forwarder start indexing locally and how to disable this?

Communicator

Hello All

I have a new environment where we have a bunch of nix webservers in a DMZ. We installed universal forwarders on those webservers and pointed those webservers to single heavy forwarder, which has permissions to send all data into our secure cell where the indexers reside. Recently the heavy forwarder is indexing the data locally and forwarding it on. I do not want the data to be indexed on the heavy forwarder locally, I just need it to be forwarded on to the main indexers. What should I be looking for to set this up properly again? I know the Splunk PS Engineer who came onsite helped set this up originally but not sure what has changed to cause it to start indexing locally again.

thanks
ed

1 Solution

SplunkTrust
SplunkTrust

Hi edwardrose,

check your tcpout stanza in the outputs.conf file if indexAndForward is set to true

[tcpout]
indexAndForward=true

if indexAndForward=true is set, this tells the forwarder to index the data locally, as well as forward the data to receiving indexers in the target groups. If set to "false" (the default), the forwarder just forwards data but does not index it. This attribute is only available for heavy forwarders; universal and light forwarders cannot index data.

hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi edwardrose,

check your tcpout stanza in the outputs.conf file if indexAndForward is set to true

[tcpout]
indexAndForward=true

if indexAndForward=true is set, this tells the forwarder to index the data locally, as well as forward the data to receiving indexers in the target groups. If set to "false" (the default), the forwarder just forwards data but does not index it. This attribute is only available for heavy forwarders; universal and light forwarders cannot index data.

hope this helps ...

cheers, MuS

View solution in original post

Communicator

the outputs.conf file in /opt/splunk/etc/system/local had it set to true.

0 Karma