Deployment Architecture
Highlighted

Choosing "settings" - "indexer clustering" takes me to "Clustering: Search Head"; possible to fix?

Communicator

In our on-prem splunk cluster attempting to follow these steps in "Enable the peer nodes":

Enable the peer
To enable an indexer as a peer node:
1. Click Settings in the upper right corner of Splunk Web.
2. In the Distributed environment group, click Indexer clustering.
3. Select Enable indexer clustering.

... like this:

Indexer clustering

... takes me instead to a page called "Clustering: Search Head" where there's no option to "Enable indexer clustering" nor to add a new indexer to a given cluster.

Clustering: Search Head

I am assuming something's not right with our cluster configuration. Any idea how to fix it?

P.S. Context: the goal is to add a new indexer to the existing cluster from scratch (it's a freshly deployed CentOS 7 VM with no data and installed-but-not-yet-started Splunk Enterprise). However I am having difficulties following the available documentation given that the steps in it lead me to unexpected results - like what I described above.

Thanks!

0 Karma
Highlighted

Re: Choosing "settings" - "indexer clustering" takes me to "Clustering: Search Head"; possible to fix?

Communicator

If you are seeing that page it means you have the node configured as a Search head.
Click on Edit > Node Type
There you will be able to configure it as a Peer node

0 Karma
Highlighted

Re: Choosing "settings" - "indexer clustering" takes me to "Clustering: Search Head"; possible to fix?

Communicator

Thanks - I am still confused. The web page I am on is hosted by a SH node on a production cluster. If I go to "Edit > Node type" and change the configuration to, say, "peer node" - will it reconfigure the SH as an indexer? (Definitely not what I want to do. This will break things, people will get mad at me, and I may not live till tomorrow.)

P.S. Splunk web is only running on the search head and nowhere else. All other roles (Masters, DS, Monitoring, Indexers) are configured not to run Splunk web.

Thanks!

0 Karma
Highlighted

Re: Choosing "settings" - "indexer clustering" takes me to "Clustering: Sea

Communicator

Correct, it would change the local instance to an indexer member. It does not allow you to perform remote administration of other peers. If you aren't running Splunk web on your indexers then you'll need to use one of the other methods listed in the docs.

0 Karma