When troubleshooting data ingestion on search heads, which SH is best to use ?

[damode1]

As the title says, when troubleshooting data ingestion on search heads e.g. running an SPL to check if certain data is landing to that index or searching through an addon like aws to check its diagnostic logs on the HF.

For tests like these, which search heads are best to use, monitoring console or a regular search head or an SHC ?

[gcusello]

Hi @damode1,

when you speak of troubleshooting data ingestion, probably you're meaning of serching on Splunk.

In this case you can use every Search Head that can access data, there isn't any prefereable one.

If instead you are using SHs for inputs, it isn't correct, it's always better to have different roles (usually Universal or Heavy Forwarders) to ingest data.

The only exception is Splunk Cloud, where in the Search Heads you can do almost everything.

Ciao.,

Giuseppe