Purpose of setting

By transferring the index data of the search head to the indexer, it is possible to centrally manage the internal logs and summary indexes of the search head and indexer.

Setting method

There are two types of setting methods: setting from the WebGUI and editing the setting file.

○ Setting from WebGUI

【procedure】

• Select "Settings > Forwarding and Receiving" from the upper right of the SplunkWeb screen.
• Select Forwarding Defaults in the Forwarding and Receiving menu.
• Set 'Do you want to copy and store forwarded events locally?' to 'No' and select 'Save'.
• Select the button "Add new" on the right side of "Forwarding settings" in the forwarding and receiving menu.
• A screen for entering the data transfer destination will open, so specify the destination in the host field in the format of "host: port" or "IP: port" and select "Save".

○ Editing the configuration file Change the outputs.conf of the search head as follows.

[Setting example of internal log transfer]

*This is a setting example when distributing data to 3 indexers (Indexer A, B, C).

$SPLUNK_HOME/etc/system/local/outputs.conf

[indexAndForward]
index = false

[tcpout]
defaultGroup = test
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:test]
server=<IndexerAのIP>:<受信ポート>,<Indexer BのIP>:<受信ポート>,<Indexer CのIP>:<受信ポート>
autoLB=true

*For default installation

$SPLUNK_HOME(Linux) : /opt/splunk
$SPLUNK_HOME(Windows) : C:\Program Files\splunk

* To reflect the settings, you need to restart the Splunk service.

example

$SPLUNK_HOME/bin/splunk restart

Notes

• Since the search head's internal logs are additionally stored in the indexer, you may need to increase the size of the indexer's internal index (such as _internal) depending on the amount of traffic.
• With this setting, all data to be imported into the search head will be transferred to the indexer. If there is data other than the internal log etc. that is imported to the search head, that data will also be transferred.
• The data to be transferred is only the data added after setting. Data captured before the setting is not transferred to the indexer.