- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Indexing question on a heavy forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a main indexer in one location (production) that gets inputs from all the systems located in that production location. I have a heavy-forwarder at another location (development) that gets inputs from all the systems at this second location. If I want to keep a local copy of the index at the developement site before forwarding it to the main indexer, do I need another license?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They can share the license. Set the development HF to be a license slave to the production Indexer. On the HF go to Manager -> Licensing (for Splunk 5.x). Click 'Change to slave'. Configure as needed. Don't know if there's a difference in 6.x.
Then set up the development HF to forward its events as well as store them locally. Manager -> Forwarding & Receiving. Change to relevant settings in Forwarding Defaults and in Configure Forwarding. Again this is for 5.x - 6.x might be exactly the same.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No because it is not indexed twice. It is indexed once and then transferred.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That seems to work. My next question, is do I get hit twice for the data coming from the development site. For indexing it twice?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
