topic Re: Splunk Deployment in Deployment Architecture

Splunk Deployment

himapate — Fri, 02 Sep 2016 06:47:33 GMT

Hi ,

We are deploying Splunk in our environment and have been stuck up at a point.

We have deployed Indexer cluster in one network it consist of the following details
2 search head
4 indexer
Master node
Deployment server

Now our requirement is that we want to integrate one indexer present at a different site and network with the search head of the current cluster.

Is it possible and if so how can it be done ?

Re: Splunk Deployment

gcusello — Fri, 02 Sep 2016 11:06:39 GMT

To integrate the other indexer in the search head you have only to insert it in the search peers list of each search head.
if you want to insert it also in the indexer cluster you have to follow the related procedure you already used for the other indexers.
remember that the old logs cannot be replicated.
bye.
Giuseppe

Re: Splunk Deployment

himapate — Fri, 02 Sep 2016 11:28:48 GMT

Hi ,

Thanks for your response, the solution provided seems to be helpful.However had a doubt regarding the license.
The separate indexer has its own license and my cluster has a different license would that seem to be clashing or would be working respectively.

Re: Splunk Deployment

gcusello — Fri, 02 Sep 2016 12:35:59 GMT

Every Indexer uses own license, There aren't restrictions for the Search Heads.
In this way you can search logs from the same Search Heads both on the cluster and the separate Indexer.
Bye.
Giuseppe