In most deployments, indexers handle both parsing and indexing of events. If there is only one Splunk indexer, the search is typically handled on this server as well. An indexer, as the name implies, indexes the data. It needs direct access to fast disks, whether they are local disks, SANs, or network volumes.
In my experience, Network File System (NFS) does not work reliably for storing Splunk indexes or files. Splunk expects its disks to act like a local disk, which, at times, NFS does not. It is fine to read logs from NFS. Internet Small Computer System Interface (iSCSI) works very well for indexers, as does SAN.
The configurations that typically matter to a Splunk indexer are:
- inputs.conf: This configuration typically ...
