Initially, I have a cluster environment( 3 indexes + 1 master node)
I want to configure my setup like below:
windows data source-----> Heavy forwarder------------------> [Index cluster]------------->SH-1
Currently, only index cluster is ready and forwarding & receiving is enabled on heavy forwarder.
I want to:
1- send windows logs to two indexers (indexer 1 and indexer 2) where should I configure this
on data source or on HF?
2- send windows data to a specific index.
So:
1. where should I create the index?
Can I create an index on any indexer and it will replicate automatically?
Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers
Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.
Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment
Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers
Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.
Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment