- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- What is the server role of heavy forwarder and ind...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the server role of heavy forwarder and indexers in cluster?
In the monitoring console what is the best practice of server role for heavy forwarders? I used Indexer but not sure if there is a better suit for those? Our heavy forwarder will be the only indexer in the overview page because according to the docs for index clusters only add the search head master as a search peer? Could someone please confirm these are both accurate?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Only assign the role of Indexer if it is a search peer. And if it is an Indexer, you SHOULD NOT be using it as a Heavy Forwarder. it should be EITHER one or the other role. If you are doing both roles on a single server, get another server and split those roles.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay thanks. The MC doesn't have an option for heavy forwarder as a server role. Should I leave it blank? Also, we are using the heavy forwarder to bridge between two splunk instances on different networks and the heavy forwarder is on a dmz. Is it better to send the internal logs to the receiving Splunk location's MC or the MC on the forwarding side's Splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you give it the Indexer role, then all of your Indexer-based views will include that server and throw off the numbers. Using HF in DMZ is definitely a valid reason to have HF. I would assign it the role Heavy Forwarder even through it is not used anywhere.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can you assign it that role though? "Heavy Forwarder" is not a selectable option. Or are you doing this in a conf file regardless? Just want to be clear. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This still has not been solved in 2024. I do mess a Heavy Forwarder group/tag as well. Indexer group should only contain indexers, but we now have the HF in that group as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, to turn on internal logs. Is it better to add the heavy forwarder to the monitoring console on the receiving side or the sending side. I'm currently working in the sending side and not sure if I can force the internal logs to go to an internal source and not be forwarded with everything else?
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
