Knowledge Management
Highlighted

How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Motivator

Does anyone have any config pointers for the following scenario:

We have a Search Head, and it runs apps that generate summary index data. We would like it to store its summary indexes locally. But, it is also collecting other data (say, scripted inputs from the UNIX app), and we want to send this other (non-summary, license-using) data to the indexer. How to do this?

Highlighted

Re: How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Motivator

Evidently in 4.2 the index forwarding is much more granular.

Per the docs, you can specify exactly which indexes get forwarded in outputs.conf.

Defaults:

[tcpout]
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit

Forward all but indexes starting with Summary:

[tcpout]
forwardedindex.0.blacklist = summary.*
forwardedindex.1.whitelist = .*
forwardedindex.2.blacklist = _.*
forwardedindex.3.whitelist = _audit

View solution in original post