Is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER?

[tam82]

My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well

The first HF sends to other HF but is not indexed and the UF attached to HF1 is not showing up at all 

is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER 

[danielcj]

Hello,

To use a Heavy Forwarder as an intermediate tier, you should listen to the port that the data is being sent from the UF/HF (usually 9997) and configure the correct outputs to the Indexer tier. The first HF should also have the outputs configured to the second HF and the Indexer tier should listen to the inputs port (9997) too.

Also, the data is not indexed on the second HF, only on the Indexing tier the data is indexed.

Thanks.

[tam82]

UF1sends to HF1 (listens on 9997) the forwards to HF2(listens on 9997) (this is where UF1 gets blocked)then sends to INDX1 (listens on 9997) 

UF2 goes directly to HF2 - Index1 This works fine 

[gcusello]

Hi @tam82,

as @danielcj said, you can use an HF as a concentrator and this is the usual approach using Splunk Cloud or having restricted networks.

In this case you have to enable ports (usually 9997)  and you can use it both for UFs and HFs.

The only thing that you have to remember adding an HF as data source is that HF cooks data, so if you have some transformation or filter on your intermediate HF, you have to copy them also on the new HF, because usually HFs send already cooked logs.

Ciao.

Giuseppe

[isoutamo]

Maybe one nice to know fact is, that when you are replacing UF with HF, then you start to generate more traffic  between those hosts, as HF add more metadata to all events. Basically if you don't need to do any data manipulation (like transforms) on intermediate forwarder it's better to use UF instead of HF. Just increase UF's throughput with limits.conf if the normal 256K is not enough.