https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12978#M1110 <P>Perfect! this worked out great! Thank you very much!</P> Fri, 07 May 2010 01:35:39 GMT dhaffner 2010-05-07T01:35:39Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12973#M1105 <P>Is it possible to have indexer A distribute to indexer B and have B distribute to A? What are the settings for it. Just trying to set it up via the GUI, it all seems OK, but B cannot see any events on A. Thanks for any help!</P> Thu, 06 May 2010 03:51:27 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12973#M1105 dhaffner 2010-05-06T03:51:27Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12974#M1106 <P>Yes. You just set it up twice, repeating the steps on each side.</P> Thu, 06 May 2010 04:02:22 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12974#M1106 gkanapathy 2010-05-06T04:02:22Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12975#M1107 <P>That's what we have done, but it is only working one way, not both.</P> Thu, 06 May 2010 04:14:10 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12975#M1107 dhaffner 2010-05-06T04:14:10Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12976#M1108 <P>Any ideas why it doesn't work? We've done it on 2 other indexers with no problems. Where do we start looking?</P> Thu, 06 May 2010 04:51:41 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12976#M1108 dhaffner 2010-05-06T04:51:41Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12977#M1109 <P>Have you checked whether the same field extractions exist on both servers? </P> <P>In distributed search the search-time knowledge that gets used is solely on the search head. so if the field extractions/lookups/eventtypes etc are different, you will get different results, and if your search uses one of the missing items, frequently 0 results.</P> Thu, 06 May 2010 05:14:05 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12977#M1109 sideview 2010-05-06T05:14:05Z https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12978#M1110 <P>Perfect! this worked out great! Thank you very much!</P> Fri, 07 May 2010 01:35:39 GMT https://community.splunk.com/t5/Splunk-Search/distributed-search-both-ways/m-p/12978#M1110 dhaffner 2010-05-07T01:35:39Z