Deployment Architecture

Choosing "settings" - "indexer clustering" takes me to "Clustering: Search Head"; possible to fix?

mitag
Contributor

In our on-prem splunk cluster attempting to follow these steps in "Enable the peer nodes":

Enable the peer
To enable an indexer as a peer node:
1. Click Settings in the upper right corner of Splunk Web.
2. In the Distributed environment group, click Indexer clustering.
3. Select Enable indexer clustering.

... like this:

Indexer clustering

... takes me instead to a page called "Clustering: Search Head" where there's no option to "Enable indexer clustering" nor to add a new indexer to a given cluster.

Clustering: Search Head

I am assuming something's not right with our cluster configuration. Any idea how to fix it?

P.S. Context: the goal is to add a new indexer to the existing cluster from scratch (it's a freshly deployed CentOS 7 VM with no data and installed-but-not-yet-started Splunk Enterprise). However I am having difficulties following the available documentation given that the steps in it lead me to unexpected results - like what I described above.

Thanks!

Labels (3)
0 Karma

anthonymelita
Contributor

If you are seeing that page it means you have the node configured as a Search head.
Click on Edit > Node Type
There you will be able to configure it as a Peer node

0 Karma

mitag
Contributor

Thanks - I am still confused. The web page I am on is hosted by a SH node on a production cluster. If I go to "Edit > Node type" and change the configuration to, say, "peer node" - will it reconfigure the SH as an indexer? (Definitely not what I want to do. This will break things, people will get mad at me, and I may not live till tomorrow.)

P.S. Splunk web is only running on the search head and nowhere else. All other roles (Masters, DS, Monitoring, Indexers) are configured not to run Splunk web.

Thanks!

0 Karma

anthonymelita
Contributor

Correct, it would change the local instance to an indexer member. It does not allow you to perform remote administration of other peers. If you aren't running Splunk web on your indexers then you'll need to use one of the other methods listed in the docs.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...