Knowledge Management

Pooled search heads in distributed search - disable indexing and forward all data to indexers?

msarro
Builder

Hello everyone. I have been combing around about this issue and haven't found a lot of concrete information. From what the wiki says, I need to create an outputs.conf file on all of the search heads that contains this stanza:

- outputs.conf
#Forward everything
[tcpout]
forwardedindex.filter.disable = true

However this only sets up forwarding for the _internal index. How can I completely disable indexing on the pooled search heads, and set them to forward absolutely everything to the indexers? Is this fully documented anywhere? Some of the older documents suggested turning the search heads into lightweight forwarders, but they don't exist anymore, and splunkweb doesn't exist (to my knowledge) on universal forwarders.

Based on this question:
http://answers.splunk.com/answers/69365/forwarding-summary-index-from-search-head-to-indexer

The outputs.conf should be configured in a way that matches my main outputs.conf on my forwarders, but it doesn't discuss any settings for inputs or how to route all information to those outputs.

I have spent the past 48 hours backfilling into a summary index, only to realize that the data seems to be split between all 3 of my search heads, so I need to start over. Any advice would really be appreciated.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know where you got that above stanza from, but what you actually need is an outputs.conf that is exactly like the ones you'd put on a forwarder to send to the indexers, e.g.,

[tcpout]
defaultGroup = myindexers

[tcpout:myindexers]
server = indexer1,indexer2,indexer3

msarro
Builder

So does this actually disable all local indexing on the search head, and forward all data to the indexers?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...