Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: what is Index , search and Heavy forwarder a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what is Index , search and Heavy forwarder and how they are related each other please i need help
I have 3 Ubuntu machine , but i dont know what index , search and heavy forwarder and how they are related to each other .
Please help me i am vary new into IT Security and i got splunk as an first project
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you installed Splunk Enterprise on the machines?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You simply need to install Splunk Enterprise on 3 linux machines and configure one to forward and one to be a search only.
http://docs.splunk.com/Documentation/Splunk/latest/Installation/Whatsinthismanual
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi n00badmin
Please i need your small help here what need to be a machine work as index , search or heavy Forwarder as per configration wise
sujeet
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First you should do some reading. Splunk documentation is some of the best
http://docs.splunk.com/Documentation/Splunk
A heavy forwarder is a full install of splunk that forwards data to an indexer.
The indexer indexes the data into indexes searchable from the searchhead.
START HERE : http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please i need brief answer
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
