topic Re: Multiple search heads, one indexer in Deployment Architecture

Multiple search heads, one indexer

smileyge — Mon, 02 Jun 2014 11:35:04 GMT

Is it possible to set up several search heads to search the same index if, say, I wanted a particular search head to only search an index or two, and leave the other one searching all indexes. I would not add another indexer.

Re: Multiple search heads, one indexer

lpolo — Mon, 02 Jun 2014 12:16:13 GMT

Yes. It is possible to define the specific search peers you need in each search head.
More information:

http://docs.splunk.com/Documentation/Splunk/6.1.1/DistSearch/Configuredistributedsearch

Thanks,
Lp

Re: Multiple search heads, one indexer

smileyge — Mon, 02 Jun 2014 12:56:23 GMT

I have seen that as well as the docs on search pools, so thanks for helping me understand which one I want. When adding a peer, what license file is used and does replicating the data consume license volume?

Re: Multiple search heads, one indexer

lpolo — Mon, 02 Jun 2014 13:11:36 GMT

Each indexer and search head has its own license configuration. If you are using a license server all the indexers and search heads has to point to the same license server. If you have 2 license servers, you could have a set of indexers and search heads pointing to one license server and the other set pointing to the other license server.
More information about license server:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/HowSplunklicensingworks