topic Re: Summary indexeing in Distributed Search environment in Getting Data In

Summary indexeing in Distributed Search environment

linu1988 — Thu, 27 Feb 2014 14:43:50 GMT

Hello,
I was planning for summary indexing. I did two custom indexes and ran the searches. After couple of days i remembered that i should create those indexes in the indexers rather than in search head for better maintainability. I created the indexes in indexers and remove the original from the search head.

Now when i try to assign them in savedsearch now they show up but give me error that the indexes don't exist!!! What do i need to do now, any one has any experience with it?

Thanks in advance.

Re: Summary indexeing in Distributed Search environment

somesoni2 — Thu, 27 Feb 2014 15:38:00 GMT

The index with same name should exist locally where you're scheduling the summary index search (I guess its search head in your case). The data will still be stored in the index inside Indexer, but a local reference is needed at search head.

Re: Summary indexeing in Distributed Search environment

sloshburch — Thu, 27 Feb 2014 15:45:09 GMT

Agree with linu1988 - To work around this same challenge, we have a master indexes.conf in a customer app that the deployment server sends to all of the indexers and the search heads. It allows the indexes to show up in the UI but given that the forwarders only send data to the indexers I don't have to worry about the Search Heads having any data.

Re: Summary indexeing in Distributed Search environment

linu1988 — Thu, 27 Feb 2014 18:09:13 GMT

you guessed right, i will give it a try tomorrow and let you know the result if it really re-directs to indexers only. Thanks

Re: Summary indexeing in Distributed Search environment

linu1988 — Thu, 27 Feb 2014 18:10:01 GMT

I got your point, will see the results tomorrow after creating the indexes in search head.

Re: Summary indexeing in Distributed Search environment

linu1988 — Tue, 11 Mar 2014 15:33:03 GMT

i have done the steps, the indexes are present in all the servers i.e. search head and indexers. It still stores all the data in search head not using the indexer index. Could you tell if i am missing anything?

Re: Summary indexeing in Distributed Search environment

linu1988 — Tue, 11 Mar 2014 15:33:37 GMT

i have done the same, still it stores data only in search head. not in indexer

Re: Summary indexeing in Distributed Search environment

sloshburch — Tue, 11 Mar 2014 15:38:21 GMT

Make sure the SH has no receiving port listening (so it won't start indexing anything from a forwarder). You will need to make sure that the indexes on the SH are forwarded to the indexers as well.

Re: Summary indexeing in Distributed Search environment

linu1988 — Tue, 11 Mar 2014 15:59:19 GMT

how do i forward the index from search head to indexer? they are already present in the indexer with same name..

Re: Summary indexeing in Distributed Search environment

sloshburch — Wed, 12 Mar 2014 14:52:55 GMT

Simply turn on forwarding on the search heads in the same fashion as you would for any heavy forwarder. Take a peek in the splunk documentation for this one.

Cool?