I read that the distsearch.conf is to configure only distributed search. In order to set the distributed search , I have set the distsearch.conf ENABLED in my Splunkweb(Search head).
It creates the file in the Search head --> (distsearch.conf)
In my deployment , I have
Do i need to add all the Splunk instance(incl. forwarder,deployment server) in 'servers' attribute ? or only the search head IPs ?
#This file contains possible attributes and values you can use to configure distributed search.
servers = 10.x.x.x:8089,10.x.x.x:8089