Getting Data In

How to forward events to a cluster environment?

riqbal
Communicator

Initially, I have a cluster environment( 3 indexes + 1 master node)

I want to configure my setup like below:

windows data source-----> Heavy forwarder------------------> [Index cluster]------------->SH-1

Currently, only index cluster is ready and forwarding & receiving is enabled on heavy forwarder.

I want to:

1- send windows logs to two indexers (indexer 1 and indexer 2) where should I configure this
on data source or on HF?

2- send windows data to a specific index.
So:
1. where should I create the index?
Can I create an index on any indexer and it will replicate automatically?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Ans 1: You windows event log collection would happen on your Windows data source (where I assume you've Splunk Universal Forwarder installed) via inputs.conf. Which should send it to the Heavy forwarder, so your UF should've outputs.conf to forward data to HF. The HF should've outputs.conf with load-balanced forwarding to your indexers

Ans 2: The inputs.conf on your UF allows you to specify the index name where you want your data to be stored.

Ans 3: The index should be created in Indexer Cluster. Since it's a cluster, the index creation related configuration should be deployed via cluster master. See this: http://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Manageappdeployment

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...