I am searching data on search head and indexer, I have also tried capturing packet in HF and indexer.
No, master is not indexing data.
master_uri = https://ma1server.mydomain.com:8089
[indexAndForward]
index = false
[tcpout]
defaultGroup = SplunkIndexers
forwardedindex.filter.disable = true
[tcpout:SplunkIndexers]
# discover the Indexers from the master node
indexerDiscovery = splunk_master
# heartbeats between forwarder and indexer, default is 30 seconds
heartbeatFrequency = 30
# increase the maximum output queue size
# default setting is auto
# default size is 500KB when useAck is disabled and 21MB when enabled
maxQueueSize = auto
# ensure reliable delivery by confirming with the Indexers that they have received each event
useACK = true
# disable SSL compression
useClientSSLCompression = false
... View more