topic Re: Distributed search set up between A and B, node B missing source in Deployment Architecture

Distributed search set up between A and B, node B missing source

orjanb314 — Wed, 29 Sep 2010 19:23:05 GMT

In my company we have 2 servers running Splunk 4.1.5. Each one has the other configured to be a search peer in distributed search. So far only node A receives data for indexing and node B has only the default inputs. On node B most of the data from A is visible, but it's clear that much is missing. Most importantly no data with our Blucoat proxy as source shows up on node B.

I have also installed Splunk locally on my PC and configured it with both A and B as search peers. It has the same data as node B available. Anyone have any possible answers for this at the top of their heads?

Edit: I have made some screenshots to illustrate. I feel like I'm missing something very basic here, but I'm just a newbie. 😉

Splunk 1 Splunk 2

Re: Distributed search set up between A and B, node B missing source

Genti — Thu, 30 Sep 2010 04:16:11 GMT

what are the searches that you are doing in both indexer A and indexer B to view the bluecoat data?

Re: Distributed search set up between A and B, node B missing source

gkanapathy — Thu, 30 Sep 2010 11:14:34 GMT

It seems likely that the "missing" data on A is in a non-default index. Queries from your PC and from node B are implicitly querying the default indexes (as defined on the machine from which you run the search). Node A probably has modified its local default indexes to include the index containing your "missing" data.

You could test this by explicitly querying for index=* (assuming that on your PC/node B that you are in fact allowed to query for those indexes).

Re: Distributed search set up between A and B, node B missing source

orjanb314 — Thu, 30 Sep 2010 13:19:31 GMT

As far as I can see it doesn't matter what searches I do, the data simply isn't available on B.

Re: Distributed search set up between A and B, node B missing source

canadianman — Tue, 20 Sep 2011 19:26:03 GMT

If you need some help with this just go into the splunk support page, they have all the information there.

Re: Distributed search set up between A and B, node B missing source

canadianman — Tue, 20 Sep 2011 19:26:45 GMT

If you still have a problem with this, just go into the splunk support page and they have all the infirmations there.