topic Re: Splunk 5 and search indexers in Getting Data In

Splunk 5 and search indexers

asarolkar — Tue, 12 Feb 2013 23:51:02 GMT

Hi,

We were using a system which has a central Splunk head and multiple search peers where the search peers were DISABLED.

Is it possible that an upgrade to Splunk 5 re-enabled them ?

I went to Splunk Manager -> Licensing -> Enterprise license group and I see that ALL MY SEARCH PEERS AS WELL AS MY SEARCH HEAD are using up daily volume.

I doubt that that is the case (that an upgrade can re-activate configuration), but is it actually possible for something like this to happen ?

Re: Splunk 5 and search indexers

Ayn — Tue, 12 Feb 2013 23:59:57 GMT

Not an answer, but a sidenote - I think you're confusing search heads and search peers here. A search head performs searches on search peers (peers are typically indexers).

Re: Splunk 5 and search indexers

asarolkar — Wed, 13 Feb 2013 00:01:19 GMT

Hi there,

I phrased my question correctly now !

Re: Splunk 5 and search indexers

yannK — Wed, 13 Feb 2013 17:07:31 GMT

if the search was disabled for any license issue, you need a reset key to unlock the search.
If you have a support contract, file a ticket, otherwise, wait for 30 days for the automatic unlock.

Re: Splunk 5 and search indexers

ksusia — Tue, 27 Aug 2013 12:23:18 GMT

thanks!!!!!!
i got solved problem for you!!!!