topic Re: Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle in Getting Data In

Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

Damien_Dallimor — Mon, 17 Oct 2011 23:08:00 GMT

I'm setting up several Search Peers(Indexers) and a pool of Search Heads using the combined mount approach from the Splunk docs :

"For multiple search heads, you can
combine mounted bundles with search
head pooling. The pooled search heads
maintain one bundle on the shared
storage, and all search peers access
that bundle".

Will the Search Peers obtain their entire configuration from the mounted knowledge bundle, or just the knowledge pertaining to distributed search requests ?

ie: on each Search Peer do I also have to locally(or using Deploy Manager, Puppet etc..) setup the index definitions, index time transforms & receiving ?

Re: Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

gkanapathy — Tue, 18 Oct 2011 00:29:07 GMT

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

Re: Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

Damien_Dallimor — Tue, 18 Oct 2011 00:35:32 GMT

Thanks GK.