https://community.splunk.com/t5/Getting-Data-In/sending-data-to-multiple-indexers/m-p/21385#M96522 <P>Well, the easiest way to do that would be to set up distributed search on the <EM>other</EM> search head(s) so that they also search this indexer. </P> <P>An example will make this clearer, I hope:-)</P> <P>Indexer A</P> <UL> <LI>standalone (running as search head and indexer)</LI> <LI>with DBX</LI> </UL> <P>Indexer B</P> <UL> <LI>standalone (search head and indexer)</LI> <LI>indexing other stuff</LI> </UL> <P>Search Head C</P> <UL> <LI>searches across indexers D, E, F</LI> </UL> <P>On either B or C (or both), you can configure <STRONG>Distributed Search</STRONG>. It's in the Splunk Manager UI.<BR /><BR /> Go to <STRONG>Distributed Search Setup</STRONG> - by default it is turned on; if it is on, you can leave everything at the defaults.<BR /><BR /> Go to <STRONG>Search Peers</STRONG> and <STRONG>Add New</STRONG>. Enter the info for Indexer A.<BR /><BR /> Wait a few minutes and then run a search on B or C - whichever you set up - and you should see the data from Indexer A.</P> Wed, 01 May 2013 18:56:44 GMT lguinn2 2013-05-01T18:56:44Z https://community.splunk.com/t5/Getting-Data-In/sending-data-to-multiple-indexers/m-p/21384#M96521 <P>I have DBX currently on a standalone splunk install (acting as both SearchHead and Indexer). I need to be able to send DB data retrieved via DBX to multiple indexers (not just the splunk instance that DBX is installed on). How is this configured ?</P> Wed, 01 May 2013 18:38:56 GMT https://community.splunk.com/t5/Getting-Data-In/sending-data-to-multiple-indexers/m-p/21384#M96521 frankfowler 2013-05-01T18:38:56Z https://community.splunk.com/t5/Getting-Data-In/sending-data-to-multiple-indexers/m-p/21385#M96522 <P>Well, the easiest way to do that would be to set up distributed search on the <EM>other</EM> search head(s) so that they also search this indexer. </P> <P>An example will make this clearer, I hope:-)</P> <P>Indexer A</P> <UL> <LI>standalone (running as search head and indexer)</LI> <LI>with DBX</LI> </UL> <P>Indexer B</P> <UL> <LI>standalone (search head and indexer)</LI> <LI>indexing other stuff</LI> </UL> <P>Search Head C</P> <UL> <LI>searches across indexers D, E, F</LI> </UL> <P>On either B or C (or both), you can configure <STRONG>Distributed Search</STRONG>. It's in the Splunk Manager UI.<BR /><BR /> Go to <STRONG>Distributed Search Setup</STRONG> - by default it is turned on; if it is on, you can leave everything at the defaults.<BR /><BR /> Go to <STRONG>Search Peers</STRONG> and <STRONG>Add New</STRONG>. Enter the info for Indexer A.<BR /><BR /> Wait a few minutes and then run a search on B or C - whichever you set up - and you should see the data from Indexer A.</P> Wed, 01 May 2013 18:56:44 GMT https://community.splunk.com/t5/Getting-Data-In/sending-data-to-multiple-indexers/m-p/21385#M96522 lguinn2 2013-05-01T18:56:44Z