topic Re: Setting up a search head and indexer on existing machine in Splunk Search

Setting up a search head and indexer on existing machine

chintan_shah — Wed, 16 Aug 2017 18:24:17 GMT

Hi All,

Currently I have a single instance which acts as indexers as well as search head. But i am planning to include another instance and make it as indexers and use the existing machine as search head.
Could anyone explain how can i achieve that and also how can i use the existing index data for searching as well.
Thanks

Re: Setting up a search head and indexer on existing machine

Steve_G_ — Wed, 16 Aug 2017 18:36:05 GMT

This is what's known as a Splunk distributed search topology. See this topic, and the ones that directly follow it, for set-up information: http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Overviewofconfiguration

Re: Setting up a search head and indexer on existing machine

somesoni2 — Wed, 16 Aug 2017 18:45:20 GMT

It would be easier to use the existing machine as Indexer (you won't have to migrate data to new server that way) and use new machine as search head. Just install Splunk on new search head, setup licensing and add existing server as search peer (http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Configuredistributedsearch).

Re: Setting up a search head and indexer on existing machine

chintan_shah — Wed, 16 Aug 2017 18:53:36 GMT

Thanks Somesoni2, the issue is the current machine doesnt have high processing capacity (currently its 4 Core) and hence need to have new machine (8 Core) as indexer.

Re: Setting up a search head and indexer on existing machine

chintan_shah — Wed, 16 Aug 2017 20:05:14 GMT

Hi somesoni2,

If given a scenario where i have two instances ( a workstation with 4 core and another workstation with 8 core), which you will suggest to use for indexer and search head?

Re: Setting up a search head and indexer on existing machine

chintan_shah — Wed, 16 Aug 2017 20:09:13 GMT

Hi Steve G.
If given a scenario where i have two instances ( a workstation with 4 core and another workstation with 8 core), which you will suggest to use for indexer and search head?

Re: Setting up a search head and indexer on existing machine

somesoni2 — Wed, 16 Aug 2017 20:59:51 GMT

Assuming you don't have search quota issue right now, I would go with 8 core box as Indexer.

Re: Setting up a search head and indexer on existing machine

chintan_shah — Fri, 15 Sep 2017 20:09:17 GMT

Hi @somesoni2,

I have various apps,lookups,schedule searches,reports , dashboards & config file changes. Should they be present at search head or indexer?