- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Disable search feature on Indexer Cluster Nodes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have configured SHC and Indexer cluster, Is there any way to disable search feature on Indexer cluster nodes, so indexer will do indexing only and search heads will do searching only.
Thanks
Rajeev
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you mean that you don't want the Search & Reporting app to be available on the indexers? If that is what you meant then I have to ask why bother?
1) Only the Splunk administrators should have access to to the indexers, so just create the accounts for your users on the search heads and they won't even be able login to the indexers anyway.
2) What if something happens to your search heads and the Splunk administrators need to search the _internal indexes to investigate what is wrong? They would login to the indexers and do the search there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks lycollicott
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rajeev, maybe, can you please mark this as accepted answer and/or some upvotes ;). The accepted answers will help the future questioners.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you mean that you don't want the Search & Reporting app to be available on the indexers? If that is what you meant then I have to ask why bother?
1) Only the Splunk administrators should have access to to the indexers, so just create the accounts for your users on the search heads and they won't even be able login to the indexers anyway.
2) What if something happens to your search heads and the Splunk administrators need to search the _internal indexes to investigate what is wrong? They would login to the indexers and do the search there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wouldn't the indexer still be running all of the scheduled search's etc that will now be running on the new search head too?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The indexers will always receive and run a search "bundle" from the search heads for both adhoc and scheduled searches. They have to do this, because the data is there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A search head cluster consists of a group of search heads that share configurations, job scheduling, and search artifacts. The search heads are known as the cluster members.
One cluster member has the role of captain, which means that it coordinates job scheduling and replication activities among all the members. It also serves as a search head like any other member, running search jobs, serving results, and so on. Over time, the role of captain can shift among the cluster members.
Search peers - These are the indexers that cluster members run their searches across. The search peers can be either independent indexers or nodes in an indexer cluster.
so, the SHC maintains and distributes the searches, indexer cluster members will run the searches and report back the results to SHC.
i think, we can not disable the search feature on indexer cluster.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
