topic Re: Single search head and single indexer in Getting Data In

Single search head and single indexer

timsheets13 — Tue, 15 Jun 2021 13:32:40 GMT

I have seen in other threads that this questions has been asked before but I can't seem to find an answer. I have a single "all in one" instance. I have built another Splunk server and would like it to be a dedicated search head and leave the original as a dedicated indexer.

Is there a way to set this up without clustering? Obviously, no cluster is needed with one of each Splunk server role.

THanks

Re: Single search head and single indexer

gcusello — Tue, 15 Jun 2021 14:20:58 GMT

Hi @timsheets13,

you have to see in [Settings -- Distributed Search] and configure the new machine as a Search Head, setting the old machine as a Search peer.

Cluster is another thing non applicable to your architecture.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.2.0/DistSearch/Whatisdistributedsearch

Ciao.

Giuseppe