Hi
We have distributed Splunk Enterprise (1 SH, 2 Indexers, 2 Heavy forwarders)
We would like to Install Salesforce App to Search Head and install Salesforce Add-on to a Heavy forwarder.
But I don't know how to map the index name "SFDC" between SH, indexers and HF ? does it automatic detect and assign with an index name "SFDC"?
Should I manually create the index "SFDC" on all indexers and HF ?
What is default index name when install Salesforce Add-on or Salesforce App?
Thanks
Khanh Le
SFDC is the default index but you can change the inputs.conf or use the GUI to create Inputs with any index that you have created on your indexers if you are forwarding the data from the HFWD to the indexers.