topic Re: ITSI installation in Splunk ITSI

ITSI installation

ramarcsight — Tue, 29 Sep 2020 18:13:03 GMT

I have a Search Head called JOHN
- it has several search peers connected to it in distributed environment , it has around 100 Search Peers

-so EMMA search peer 1 and EMMA search peer 2 are both connected to JOHN along with another Search Peers
So now i am trying to install ITSI app in SH -JOHN
- but the indexes that r created by ITSI APP itsi_summary,
anomaly_detection etc., - shd be only written into EMMA SEARCH PEERS 1 and 2 but not in all search peers connected to JOHN.

So by placing SA-IndexCreation in only Emma indexer 1 and indexer 2 can we achieve dis ??

IS that possible?

Re: ITSI installation

ansif — Wed, 28 Feb 2018 04:46:59 GMT

Indexer clustered?

Re: ITSI installation

lloydknight — Tue, 29 Sep 2020 18:15:21 GMT

Hello @ramarcsight

Assuming your Indexers are clustered:
Given that data will be replicated on Index Clustering, try this link below to disable replication to specific peers (your EMMA search peer 1 and EMMA search peer 2).
https://answers.splunk.com/answers/376042/is-it-possible-to-disable-replication-to-specific.html

Assuming your Indexers are non-clustered:
Try to forward your data on the EMMA Indexer 1 and EMMA Indexer 2 only.
Check this link below:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_data_by_target_index

Hope it helps!

Re: ITSI installation

akhil36109 — Tue, 17 Apr 2018 04:32:20 GMT

Hello Hi

The thing is EMMA1 and EMMA2 has thier own Cluster master ,so how to create SA-IndexCreation Indexes in only Emma1 and Emma2??