I have the following setup with Indexer Discovery + Indexer Cluster + Search Head Cluster: - Deployment Server - 3 X Indexer + Cluster Manager (Indexer Cluster) - Search Head Deployer + Search Head (Set-up as part of a SHC for possible future scaling up)   For forwarding logs from Cluster Manager, I referred to: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Forwardmanagerdata For forwarding logs from Search Head Cluster nodes, I referred to: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata I believe forwarding logs from the Deployment Server should be similar to the above.   For indexers belonging to an indexer cluster, I have considered the following: 1. Install UF in each indexer to monitor & forward logs to the indexer cluster (via indexer discovery) 2. Just monitor logs locally and allow each indexer to index its own local logs (without going through the indexer cluster) 3. Configure the indexer to forward the locally monitored logs without indexing, to the indexer cluster. I am not sure if is necessary to ensure that it does not index the same data twice. Unsure on how this would play out. Option 2 seems to be the easiest to achieve, but ideally I would like all logs to go through the indexer cluster for indexing. What should be the best practice for forwarding logs from indexers that are part of the indexer cluster?   ... View more