topic Re: peer nodes vs. indexer nodes in Knowledge Management

peer nodes vs. indexer nodes

tim_snider — Thu, 19 Dec 2013 16:25:10 GMT

Basic / understanding question here.
The documentation refers to both indexer and peer nodes. After reading it is true that:
Peer nodes are indexers and that all peer nodes also have indexer functionality;
Peer nodes also replicate data to other peer nodes?
Do all peer nodes serve as indexers - are the other responsibility / functionality differences between peers and indexers? Is there a concept as a "straight indexer node"?
A RTFM response is fine 😉 just point me to a page (please).
Thx.

Re: peer nodes vs. indexer nodes

dmaislin_splunk — Thu, 19 Dec 2013 16:41:46 GMT

Sorry for the confusion. Peer nodes are your indexers. They are all peers to each other. The search head sends a search down to the peers where the peers(indexer) run the search and return the results back to the search head. If you also have a Splunk cluster defined, then you can tell your indexers to make N number of copies of the indexed data across the peers. This can have a replication factor and a search factor where a search factor also replicates the meta data.

Re: peer nodes vs. indexer nodes

kristian_kolb — Thu, 19 Dec 2013 16:49:30 GMT

Well you are basically right. When setting up Distributed Search, with a dedicated Search Head, and one or more Indexers, those Indexers are referred to as "search peers", whereas in a cluster setup, the servers that are indexing incoming data and replicating indexed data between themselves are referred to as "peer nodes". In a single server setup, there will be no peers, just a combined search head/indexer.

So yes, you could say that indexer = peer, but if you want to thoroughly correct, I believe you could say that an indexer indexes data, and the peer responds to remote requests for data. It's all about which point of view you have.

http://docs.splunk.com/Splexicon:Peernode
http://docs.splunk.com/Splexicon:Searchpeer
http://docs.splunk.com/Splexicon:Indexer

Hope this helps,

Re: peer nodes vs. indexer nodes

kristian_kolb — Thu, 19 Dec 2013 16:50:03 GMT

dang. late again!

Re: peer nodes vs. indexer nodes

tim_snider — Thu, 19 Dec 2013 16:52:53 GMT

no problem - thx for the response. Is data replicated for data availability in case of hardware failure, additional indexing capability, or both?

Re: peer nodes vs. indexer nodes

dmaislin_splunk — Thu, 19 Dec 2013 16:55:59 GMT

Replicated for data availability. A search does not run parallel if the data exists in two places at once. The cluster master tells the search head which places to go get the data. If something goes down, the cluster master updates the list of peers to search.

Re: peer nodes vs. indexer nodes

dmaislin_splunk — Thu, 19 Dec 2013 16:56:30 GMT

But you included the links 🙂

Re: peer nodes vs. indexer nodes

dmaislin_splunk — Thu, 19 Dec 2013 16:57:23 GMT

Please accept this answer with the check box if it meets your needs. Thanks!