Hello there! I do not have my internal events from my index cluster master in my index cluster. Do I need to configure an outputs.conf on it? Since I use indexer discovery, do I user localhost as a place to get the list of indexers?
I have assumed that being it is apart of the cluster it would redirect it's own logs to the cluster index layer.
Ultimately, the recommendation is you have all your splunk instances forward their logs to the indexer layer.
This means that you want the same outputs.conf on the search-heads, cluster-master, forwarders, license-masters, deployer... to sent to your indexers layer.
(but no need to have the indexers forwarding to themselves)
If you are using indexer discovery, the cluster-master should behave like the forwarders.
You wrote "If you are using indexer discovery, the cluster-master should behave like the forwarders." What exactly does that mean? I am in fact using index discovery.
Thanks!
So then in outputs.conf i specify localhost when configuring index discovery?