topic Re: Splunk Upgrade Requirement Clarification in Splunk Enterprise

Splunk Upgrade Requirement Clarification

R15 — Tue, 03 Jan 2023 22:15:25 GMT

Hi,

We're preparing to upgrade SE from 8 to 9 and have a question about this requirement:

For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions:

...
...
They do not run their own saved searches

If our indexers are also search heads, would that violate this?

Re: Splunk Upgrade Requirement Clarification

richgalloway — Wed, 04 Jan 2023 14:33:06 GMT

Indexers should not also be search heads, unless you have a collection of standalone Splunk instances (which would be uncommon).

A standalone instance is not a distributed deployment so the listed conditions do not apply.

In a distributed deployment, search head and indexer instances are on separate machines and the SHs send search requests to the indexers for fulfillment. If this is the case at your company and you also have the indexers acting as search heads then you must make sure the indexers do not have their own saved searches.

Re: Splunk Upgrade Requirement Clarification

R15 — Wed, 04 Jan 2023 16:58:51 GMT

@richgalloway
I'm new here and still trying to wrap my around this as I prepare to help upgrade and then later expand our setup. It's a very small deployment (for now), 2 indexers which are also search heads with replication between indexers. Would this mean ALL of our saved searches violate the above?

Re: Splunk Upgrade Requirement Clarification

richgalloway — Wed, 04 Jan 2023 17:52:10 GMT

What you describe sounds like a non-standard installation. If the indexers are replicating buckets to each other then that would be an indexer cluster, which should not also be operating as search heads. With an indexer cluster, the search heads should be separate instances.

To answer your question, yes, I believe all of your saved searches present on the indexers would violate the condition.