Why does the distributed management console show my search head as an indexer?

reswob4 — Tue, 16 Feb 2016 16:18:58 GMT

So I've tried the following suggested configurations:

http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Forwardsearchheaddata
https://answers.splunk.com/answers/30622/how-to-turn-off-indexing-on-dedicated-search-head.html (doesn't seem to apply to 6.3.3)
https://answers.splunk.com/answers/106166/if-there-is-an-outputs-conf-on-a-dedicated-search-head-does-it-index-anything.html

and here is my /opt/splunk/etc/apps/all_forwarder_outputs/local/outputs.conf

BASE SETTINGS

[indexAndForward]
index = false

[tcpout]
defaultGroup = primary_indexers
indexAndForward = false

[tcpout:primary_indexers]
server = indexer1:9997, indexer2:9997

autolb settings

autoLB=true
autoLBFrequency=15
forceTimebasedAutoLB=true

Yet when I look at my Distributed Management Console, it still thinks my search head is also an Indexer.

Is there another outputs.conf I should be configuring?

Thanks

Re: Why does the distributed management console show my search head as an indexer?

vasildavid — Tue, 16 Feb 2016 16:34:29 GMT

For the DMC app, there is a "General Setup" page under the "Settings" pulldown. Under this page you can set your server roles by editing your servers and assinging whether they are a Search Head, Indexer, License Server, etc.

topic Re: Why does the distributed management console show my search head as an indexer? in Getting Data In

Why does the distributed management console show my search head as an indexer?

Re: Why does the distributed management console show my search head as an indexer?