Deployment Architecture

Distributed search from a SH Cluster to multiple Indexer Clusters

Aatom
Explorer

Hey Splunkers!

We have multiple IDX/SH clusters that are peered based on regulatory/compliance/operational reasons. We have a specific SHC that we would like to de-peer from an older IDX cluster. Indexes are reused and migrated across different IDX clusters frequently.

What is the fastest and most accurate way to see what data is being fetched from the IDX clusters by a SHC?

Thanks in Advance!

Labels (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi.  Just by searching answers I found these two: You can list the indexers your heads are talking to with

| rest /services/server/info | table splunk_server

 You can list all the indexes with tstats (you would need a large window of time, possibly)

| tstats count WHERE index=* by index | table index

 

0 Karma

Aatom
Explorer

Thanks @burwell , we know we are currently peered, and am familiar with both the options you provided, but I am trying to go deeper. What I would like to find is an output that shows actual results (bytes, buckets, meta, etc) returned from the Indexer Cluster we want to de-peer from, based on the outgoing queries from the SHC.

0 Karma

burwell
SplunkTrust
SplunkTrust

You want to know when your users are querying the indexers you want to de peer from?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...