We currently have one server running the indexer and search head. We're looking into adding a second indexer on a different host to take advantage of license pools. The new indexer would be set up to where only a subset of our clients would be pointing to it as we've had issues with another group consuming too much of our license. If we take that approach, will the data be replicated between both indexers to where we can take advantage of additional search resources or do indexers only keep they data being sent to them by the forwarders configured to use them?
Ok, so I'm a little confused on the data the forwarders are sending. Do you have to load balance the forwarders between all indexers or can I point forwarders A,B,C to indexer 1 and forwarders D,E,F to indexer 2 and still have replication work correctly?