Distributed Development

[Zombiesunday261]

About defining fixed roles meaning
Sh should only do search
Idx should only do indexing
Hf should only do log ingestion and parsing

No other extra capabilty should be utilised // can i do that ( and yes we can disable the web ui of idx or HF ) we have to change to core capabilty only like disabling the search or prasing

[PickleRick]

Indexer does its share of searching. It is a part of a searching process - it's how Splunk works.

I assume you don't want users to use it to search from it directly, right?

Generally, regardless of whether you leave the WebUI enabled or not on non-SH components, you usually simply don't allow normal users to log in there. HF shouldn't even have indexers configured as search peers so you'd have no data to search from.

I'm not sure what is your point here.

[gcusello]

Hi @Zombiesunday261 ,

at first, disable web GUI for the HF could be applicable only if you don't have in your HFs DB-Connect or Add-Ons that require configuration (e.g. Azure or AWS, etc...).

About the disabling of search, it is really disabled because on IDXs you can search only on the _internal on the same IDX, not on all the other IDXs and on the HFs you don't have any result if you perform a search.

Then I don't understand what you mean with "prasing".

Anyway, it's a best practice to separate roles, e.g. not using a Search Head to run ad Add-On for cloud services or not use a HF to manage local indexes.

How can I help you more?

Ciao.

Giuseppe