Deployment Architecture

Distributed Summary Indexing from Search Head

mattcg
Explorer

Hello,

I'm looking to set up our search head to send summary index data it generates back to our indexers in a distributed environment.

I found the following question, and I understand the theory of the answer. However, I don't know specifically how to set up the search head as a forwarder and how to tell it to forward the summaries generated instead of indexing them.

http://answers.splunk.com/questions/5837/summary-indexing-on-a-search-head

Furthermore, is Splunk intelligent enough to determine that summaries generated by a search head and then forwarded back down to our indexers are summaries and therefore not count them toward our license?

Thanks for any guidance.

1 Solution

Brian_Osburn
Builder

Hi Matt - Having gone through this before, I can say that anything forwarded from the Search head to the indexers is NOT counted toward your license cost. You can even set up the Search head to use the forwarder license included with the app.

With regards to setting up the Search head as a forwarder, it's the same process as you would use for any other forwarder. You can find the details here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving#Set_up_forward....

Now, there's one caveat. If you use custom named summary indexes, you'll have to make sure they're created in the indexes.conf on the Indexers as well.

Hope this helps! Brian

View solution in original post

sabaKhadivi
Path Finder

I did it and internal,audit , introspection also copied to indexer, how can I change configuration in the way it exclude internal indexes

0 Karma

Brian_Osburn
Builder

Hi Matt - Having gone through this before, I can say that anything forwarded from the Search head to the indexers is NOT counted toward your license cost. You can even set up the Search head to use the forwarder license included with the app.

With regards to setting up the Search head as a forwarder, it's the same process as you would use for any other forwarder. You can find the details here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving#Set_up_forward....

Now, there's one caveat. If you use custom named summary indexes, you'll have to make sure they're created in the indexes.conf on the Indexers as well.

Hope this helps! Brian

View solution in original post

Splunk_U
Path Finder

I have also tried the same. I have a srch head and two indexers. I tried to forward the summary index from the srch head to both the indexers. Now for one of the Indxers it is working fine but for the other one it is not working.

0 Karma

Jason
Motivator

Not everything forwarded from a SH to an indexer is license free - only things that are license-free anyways, such as internal logs and summary indexing. It is possible to bust a forwarder license with something like the UNIX app inputs and no indexer to forward to!

mattcg
Explorer

Excellent. That's exactly what I was looking for, and I forgot to mention that we do use custom named summary indexes. I will try the setup as you suggest and report back. Thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!