topic Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that? in Deployment Architecture

How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

nishwanth — Tue, 26 Jul 2016 17:27:07 GMT

I have 4 servers in which 2 are clustered and are used as search heads, a 3rd one is Splunk Enterprise Security, and the 4th server is search head pooling. These are connected to indexers. I want to know how to find whether the environment is clustered or distributed. If it is distributed, then how should I add new index to it and pull logs into that index?

Thanks,
Nishwanth

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

martin_mueller — Tue, 26 Jul 2016 17:43:46 GMT

To find out if a search head is running in a search head cluster, run this on the search head:

$SPLUNK_HOME/bin/splunk show shcluster-status

To find out if a search head is running in a search head pool, run this on the search head:

$SPLUNK_HOME/bin/splunk pooling display

To find out if an indexer is running in an indexer cluster, run this on the indexer:

$SPLUNK_HOME/bin/splunk show cluster-status

To define indexes in an indexer cluster, check out the docs at http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Configurethepeerindexes

To pull in logs, one of the good ways is forwarding - check out the docs at http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Aboutforwardingandreceivingdata

If you have inherited a complex legacy Splunk environment with little documentation and not a lot of experience, consider getting a local partner or Splunk professional services to help you bring things back to proper health.

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

nishwanth — Tue, 26 Jul 2016 18:00:42 GMT

Thanks for your answer martin. If it is distributed how will I add new index to it.

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

martin_mueller — Thu, 28 Jul 2016 16:24:09 GMT

If your indexers are distributed but not clustered, you go back a few chapters in the manual I linked above: http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Aboutmanagingindexes

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

nishwanth — Tue, 02 Aug 2016 17:19:33 GMT

Thanks for your reply martin.

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

martin_mueller — Tue, 02 Aug 2016 20:39:39 GMT

Do mark this answer as accepted if it solved your question.

Re: How can I find whether an environment is clustered or distributed? If it is distributed, how can I add a new index to that?

ppanchal — Wed, 12 Oct 2016 17:27:02 GMT

What should be the ideal output of the below command if the indexers are not running in clustered mode?

$SPLUNK_HOME/bin/splunk show cluster-status