Deployment Architecture

Attributes to be set in distsearch.conf


I read that the distsearch.conf is to configure only distributed search.
In order to set the distributed search , I have set the distsearch.conf ENABLED in my Splunkweb(Search head).
It creates the file in the Search head --> (distsearch.conf)

In my deployment , I have

deployment server-1

heavy forwarder-1

Indexers -2

Do i need to add all the Splunk instance(incl. forwarder,deployment server) in 'servers' attribute ? or only the search head IPs ?


 #This file contains possible attributes and values you can use to configure distributed search.
servers = 10.x.x.x:8089,10.x.x.x:8089
0 Karma


In distsearch.conf

in Servers you need to add only search-peers(Indexers or where data is being stored)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...