DB Connect, Clustering and Index Replication on 5.0.3

[ericsix]

Hi All-
Currently have the following setup;

3 indexers (5.0.3) with index replication configured for 14 indexes
2 Search Heads (1 has various applications, 1 is cluster master, licensing)

I recently have added DBConnect on the SH that is the cluster master.

I have added a local index on that SH to test SQL dump and indexing, and now I want to push this index out to the cluster. I have added it to the _cluster indexes.conf, same as my other indexes and verified that it is being distributed to the indexers. However, the data isnt being sent into that index at the cluster level, only on the local index at the SH.

Do I need to install dbconnect on the cluster? But then, my question is, for the db inputs, the queries will now need to come from my indexers? Or will they still be able to run from the SH? (Security related in terms of the indexers being segregated from other segments..)

My understanding was that dbconnect is just the java bridge and odbc connector, and that there are no special requirements on the indexers...

Thanks

[hexx · Accepted solution]

My recommendation is to make the search-head forward the events it collects back to the cluster peers. Generally speaking, this is a best practice for search-heads, anyway.

[ericsix]

DOh! Simple as it was, I wasn't forwarding from the SH to the indexers. Added to outputs.conf and started replication immediately.

Thanks!