https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260860#M78274 <P>Well, I feel like a goof. It looks like it is a heavy forwarder (has a outputs.conf). I don't understand why it looks like a search peer and showing up in SoS, but you learn something everyday. Thanks to everyone who took the time to respond.</P> Thu, 24 Mar 2016 13:26:16 GMT wweiland 2016-03-24T13:26:16Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260855#M78269 <P>I'm having a problem where I have 5 indexers and 1 search head. All 5 show up in the search peers under distributed search. I've verified through the metrics.log that the indexer is receiving data. When I perform a search however, I only see events from 4 of the indexers. I performed "index=* | stats count by splunk_server" and again only 4 indexers + the search head showed up. Has anyone seen this issue before? Thank you in advance for any help or direction that can be provided.</P> Thu, 24 Mar 2016 00:52:49 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260855#M78269 wweiland 2016-03-24T00:52:49Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260856#M78270 <P>couple of questions..<BR /> Is the indexer in question up and running? <BR /> Did it ever reported back the data? <BR /> If not, is it actually getting the data from your forwarders? Check the outputs.conf if the indexer name/ip is mentioned correctly</P> Thu, 24 Mar 2016 02:27:24 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260856#M78270 pradeepkumarg 2016-03-24T02:27:24Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260857#M78271 <P>Are there any license errors recorded for this indexer? Check your license server console.</P> Thu, 24 Mar 2016 03:43:49 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260857#M78271 Jeremiah 2016-03-24T03:43:49Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260858#M78272 <P>If you run this search, how many peers return count?</P> <PRE><CODE>index=_internal earliest=-5m@m | stats count by splunk_server </CODE></PRE> <P>This should give responses from all your indexers, and if you have your SH / Component boxes configured to forward their internal logs, those also.</P> <P>If you're missing an indexer, try running the same search from the cluster master. If that doesnt return results, i would try rejoining the indexer to the cluster.</P> Thu, 24 Mar 2016 05:58:10 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260858#M78272 esix_splunk 2016-03-24T05:58:10Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260859#M78273 <P>It is up and running. I'm not sure if it has reported in the past as I'm new to this system. It is receiving 20% of the data. This was verified through the metrics.log and SoS.</P> Thu, 24 Mar 2016 13:05:23 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260859#M78273 wweiland 2016-03-24T13:05:23Z https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260860#M78274 <P>Well, I feel like a goof. It looks like it is a heavy forwarder (has a outputs.conf). I don't understand why it looks like a search peer and showing up in SoS, but you learn something everyday. Thanks to everyone who took the time to respond.</P> Thu, 24 Mar 2016 13:26:16 GMT https://community.splunk.com/t5/Splunk-Search/Indexer-not-searchable-by-Search-head/m-p/260860#M78274 wweiland 2016-03-24T13:26:16Z