Why did our heavy forwarder start indexing locally and how to disable this?

[edwardrose]

Hello All

I have a new environment where we have a bunch of nix webservers in a DMZ. We installed universal forwarders on those webservers and pointed those webservers to single heavy forwarder, which has permissions to send all data into our secure cell where the indexers reside. Recently the heavy forwarder is indexing the data locally and forwarding it on. I do not want the data to be indexed on the heavy forwarder locally, I just need it to be forwarded on to the main indexers. What should I be looking for to set this up properly again? I know the Splunk PS Engineer who came onsite helped set this up originally but not sure what has changed to cause it to start indexing locally again.

thanks
ed

[MuS · Accepted solution]

Hi edwardrose,

check your tcpout stanza in the outputs.conf file if indexAndForward is set to true

[tcpout]
indexAndForward=true

if indexAndForward=true is set, this tells the forwarder to index the data locally, as well as forward the data to receiving indexers in the target groups. If set to "false" (the default), the forwarder just forwards data but does not index it. This attribute is only available for heavy forwarders; universal and light forwarders cannot index data.

hope this helps ...

cheers, MuS

[edwardrose]

the outputs.conf file in /opt/splunk/etc/system/local had it set to true.