Running the Splunk App for AWS in a tiered environment, why does it only list indexes available locally on the heavy forwarder, not the indexers?

[nehtasplunk]

Hi folks.

We are attempting to configure the Splunk App for AWS.
The documentation for the app recommends running it on a Heavy Forwarder, but we are unsure how to get captured events stored in the indexers (As opposed to a local index on the HF itself).

We have 2 x clustered HFs, forwarding to 2 x clustered Indexers.
The Splunk App for AWS in installed on the first HF. (documentation says it should be installed on only one HF).
The HFs are a minimal configuration (designed to be torn down and rebuilt as needed) so we want to avoid save the events locally to the HF.

How do we get the the AWS events captured by the App on the HF to be stored in the indexes residing on the Indexers?
Note: As per the doco we have installed the AWS app on the HF, but when configuring the app, it only lists indexes that are available locally on the HF, not the indexers. (which to me indicates it would store the events locally on the HF).

Also, we have configured the AWS App on the HF so the config interface can be configured from the SearchHead (if this helps).

The version of Splunk App for AWS we are using is v4.2.1

Thanks.

[goodsellt]

Since the app queries the local index store, you'll have to include an indexes.conf file on those HFs with your actual indexes (you should be able to leave all the settings blank) so it knows they exist. A way to be extra safe about this is to explicitly disable IndexAndForward in your HF configurations (even though it is false by default).