topic Re: 2 Indexer and Summary in Getting Data In

2 Indexer and Summary

erick_costa — Thu, 29 May 2014 17:36:49 GMT

Hi,

          I have 2 Indexer and 1 SearchHead. Where should the data from my summary of the SH or the Indexer?

I checked and in my case they are in HS. Is this correct? I do not think anything in the documentation about this.

Regards,

Erick Eduardo

Ayn — Thu, 29 May 2014 17:44:20 GMT

Well it depends. It's not a matter of what is 'correct' - if you want the summarized data to reside on the search head, that's fine. If you want your indexers to have all data, you need to configure your search head to forward the summary events to your indexers. This is a very common question, here are some previous questions and corresponding answers:
http://answers.splunk.com/answers/5837/summary-indexing-on-a-search-head
http://answers.splunk.com/answers/39314/how-do-you-handle-summary-indexing-in-a-distributed-environment
http://answers.splunk.com/answers/69365/forwarding-summary-index-from-search-head-to-indexer

erick_costa — Thu, 29 May 2014 18:04:34 GMT

If I send my summary to the indexers, improve the performance of search?