If there is an outputs.conf on a dedicated search head, does it index anything?

[msarro]

This is a simple question I hope - exactly as stated, if there is an outputs.conf present on the search head, does it still perform local indexing, or does absolutely everything get forwarded to the indexers provided?

[_d_]

In your outputs.conf make sure you have a configuration similar to this (especially the first stanza):

[indexAndForward]
index = false

[tcpout]
defaultGroup = my-indexers

[tcpout:my-indexers]
server = indexer-1:9997, indexer-2:9997,...

[bmacias84]

That depends if you have the run splunk disable local-index. Prior to 5.0.2 _internal index was not forwarded only the _audit was. In later versions all indexes are forwarded if the outputs.conf is defined.

Additional Reading:
- Routeandfilterdatad

Hope this helps or gets you started.

[grijhwani]

It indexes whatever is determined by your inputs, transforms, and outputs. If your inputs are not defined then there is nothing to index. If your outputs are expressly redirected to another indexer, then no.

The default condition, is yes. As a minimum by default it will be indexing the local Splunk internals (audit, access and so on).

[yannK]

No, a search-head is a regular splunk (indexer).

If you add forwarding or enable the "splunkforwarder" app it becomes what we call "heavy forwarder". ( parse locally, and that forward)
And may or may not also write locally if the indexandforward option is turned on (see the answer from d)

If you enable the "SplunkLightForwarderapp" then it becomes "light weight forwarder". (do not parse locally, and forward)But the **Web interface is automatically disabled*, and it's not very useful for a Search-head.

[bmacias84]

@yannk, I thought the default behavior was that of a light forwarder?

[yannK]

remark : a dedicated search-head with a forwarding configuration will likely act like a "heavy forwarder", it means that it will parse the data locally (and therefore needs the props.conf index time definition), then forward the cooked events to the indexers, those will write them to disk (without parsing them again).

[msarro]

So, in a distributed deployment where a dedicated search head needs to forward EVERYTHING to indexers, how do you disable any local indexing? So far the best explanation I have seen so far is to "create an outputs.conf file." I'm just trying to figure it out since I can't seem to find decent documentation.