topic Re: Unable to fetch logs from Index in Search Head in Deployment Architecture

Unable to fetch logs from Index in Search Head

RAVISHANKAR — Fri, 25 Oct 2024 10:00:47 GMT

Hello,

I have configured an index inside an indexer and when i try to fetch data from that index in search head not getting any data.

when i search that same index in indexer i could get the data from the index but not from search head.

Could you please assist what configuration needs to be checked on my search head and indexer ?

Note - it's not clustered setup.

Thanks

Re: Unable to fetch logs from Index in Search Head

Jawahir — Fri, 25 Oct 2024 10:18:05 GMT

I hope you did the following configuration to connect search head with indexer. If not, then do it as mentioned below, else verify the configuration.

Configure the Indexer as a Search Peer

Log in to the Splunk web interface on your search head.
Go to Settings > Distributed Search > Search Peers.
Click Add New to add a new search peer (indexer).
Enter the management port (usually 8089) and the hostname or IP address of the indexer.
If required, enter the username and password of the indexer to establish the connection.
Click Save to add the indexer as a search peer.

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

Re: Unable to fetch logs from Index in Search Head

gcusello — Fri, 25 Oct 2024 10:14:54 GMT

Hi @RAVISHANKAR ,

did you configured Distributed Search in Settings, configuring the Indexers for searching?

Ciao.

Giuseppe

Re: Unable to fetch logs from Index in Search Head

RAVISHANKAR — Fri, 25 Oct 2024 11:08:22 GMT

@gcusello -

could you please explain a bit more in detail..

configured Distributed Search in Settings, configuring the Indexers for searching? - in indexer or in search head ??

Thanks

Re: Unable to fetch logs from Index in Search Head

RAVISHANKAR — Fri, 25 Oct 2024 11:13:40 GMT

@gcusello - yes this is done and it showing as status up and replication was successfull.

Thanks

Re: Unable to fetch logs from Index in Search Head

RAVISHANKAR — Fri, 25 Oct 2024 12:02:12 GMT

@gcusello - do we need to check anything else further ??

Re: Unable to fetch logs from Index in Search Head

gcusello — Fri, 25 Oct 2024 12:24:01 GMT

Hi @RAVISHANKAR ,

can you access other indexes or not?

Ciao.

Giuseppe

Re: Unable to fetch logs from Index in Search Head

RAVISHANKAR — Fri, 25 Oct 2024 12:40:46 GMT

@gcusello

I have one indexer and inside that i have created one index and i couldn't fetch data of that index from search head but i can fetch it from the indexer.

Thanks