topic knowledge bundle without a shared storage? in Security

knowledge bundle without a shared storage?

MarMoh — Tue, 21 May 2013 16:50:52 GMT

Hi,

I have one search head and one indexer. How can I use the Knowledge bundle without using a shared storage?

Thanks,
Maryam

Re: knowledge bundle without a shared storage?

rgcurry — Tue, 21 May 2013 19:36:13 GMT

I am curious as to what has you thinking you need/want to do this? This is designed mostly for multiple indexers. True it is a performance consideration but with your configuration I don't know that it will gain you much improvments.

Re: knowledge bundle without a shared storage?

MarMoh — Tue, 21 May 2013 19:40:18 GMT

Well, Just doing it for the future scalability purposes.So for one search head and one indexer I do not need to use the bundle?
another question is in future if I add more indexers how much work it would be to configure the Knowledge Bundle?

Re: knowledge bundle without a shared storage?

Ayn — Tue, 21 May 2013 20:58:52 GMT

If I don't misunderstand you somehow what you're asking for is really the normal way to setup distributed search. Configure the indexer as a search peer to the search head, and the search head will automatically send the knowledge bundles the indexer needs when issuing searches. http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch

Re: knowledge bundle without a shared storage?

rgcurry — Wed, 29 May 2013 13:54:30 GMT

As Ayn said above, the Knowledge Bundle is a part of normal processing. It seems to me that you are considering Search Head pooling where the information the Search Heads send to the Indexers is made static and stored on a shared file system to which all Search Heads and Indexers can access and updated when there are changes made to these configs. More info at http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Configuresearchheadpooling. Know that there is a performance hit with this option; your milage may vary.