topic Re: Search Heads not looking for Events on Both Indexers in Splunk Search

Search Heads not looking for Events on Both Indexers

TLAZO — Tue, 29 Sep 2020 09:28:08 GMT

I have two indexers: splnkindex001 (si1) and splnkindex002 (si2). Both indexers have index replication configured for index A.
Even with this index A replication configured, it takes a couple of hours to do so. That would not be a problem if Search Heads (splnksearch001 and splnksearch002) were not looking for events on both indexers in one single search. Sometimes I will get information from the "un-updated" indexer and have to include the "splunk_server=splnkindex001" or "splunk_server=splnkindex002" on my search to double check.
Is this a normal behavior on distributed search? I thought that the search head would look for events by default on all search peers.

Re: Search Heads not looking for Events on Both Indexers

rurbina10 — Thu, 21 Apr 2016 19:34:50 GMT

On the search head(s):

Settings->Distributed Management Console
Setup->Apply Changes->Refresh

That will resolve the issue.

Now you will see both indexers under searchProviders (job's property)

searchProviders
[
"SPLNKINDEX001",
"SPLNKINDEX002"
]

Re: Search Heads not looking for Events on Both Indexers

TLAZO — Thu, 21 Apr 2016 19:56:07 GMT

Thanks Renzo. That worked