How do I know which index forwarded data goes to receiver instance ? I'm not sure about that, but i've created 2 index. One on the forwarder other on the receiver instance and here is the trick, both with the same name and I guess it might be working because the index on the receiver is increasing.
how can i make sure about that ??? and is there any way to set this up if is not correct ??
You don't need to create indexes on forwarder nodes. Indexes only need to be created at the indexer. A forwarder can influence which index forwarded data goes into at the indexer via inputs.conf, similar to as follows:
[monitor:///my/log/file.txt]
index=myindex
But, this index must exist at the indexer, or the data will fall into /dev/null
Typically the light forwarder configuration disables all local indexes, through $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/indexes.conf.
You don't need to create indexes on forwarder nodes. Indexes only need to be created at the indexer. A forwarder can influence which index forwarded data goes into at the indexer via inputs.conf, similar to as follows:
[monitor:///my/log/file.txt]
index=myindex
But, this index must exist at the indexer, or the data will fall into /dev/null
Typically the light forwarder configuration disables all local indexes, through $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/indexes.conf.
I'm sorry for my ignorance dwaddle, but where can I find this file ??
Thank you very much