Getting Data In

Question on indexing

hrithiktej
Communicator

We have 2 linux boxes that serve as indexers plus our syslog servers, there is no fowarder in picture since we have syslog and indexer on the same box. I was wondering how does the indexing happen without the forwarder how is indexer picking up logs from syslog folder.

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

A Splunk indexer is a Splunk enterprise installation and can therefore have an inputs.conf.

An indexer's primary purpose is to index data, but it can also read data from it's own filesystem for indexing (it does this for internal logs by default, in the case you mentioned it is likely reading from the syslog directories).

However if you have an indexer cluster you might want to have a forwarder (on a separate machine) to receive syslog data and then send the data down to the indexer cluster to ensure the data is evenly spread over the cluster members.

View solution in original post

gjanders
SplunkTrust
SplunkTrust

A Splunk indexer is a Splunk enterprise installation and can therefore have an inputs.conf.

An indexer's primary purpose is to index data, but it can also read data from it's own filesystem for indexing (it does this for internal logs by default, in the case you mentioned it is likely reading from the syslog directories).

However if you have an indexer cluster you might want to have a forwarder (on a separate machine) to receive syslog data and then send the data down to the indexer cluster to ensure the data is evenly spread over the cluster members.

hrithiktej
Communicator

Thanks I figured out remote logs are received via syslog and then written to a local file on the indexers and monitored locally in our case. And we do have a f5 load balancer before the indexer cluster

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...