- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am working with two Splunk standalone environments where each environment is a single server that acts as search head and indexer. Users currently have to log into both environments to run reports. They want to only log into one server and run a combined report. I understand that the optimal solution is to have one environment but this is not currently possible. Can I update the distributed search settings in System A to search both itself and also System B? Looking at the docs for distributed search I see this line:
Important: A search head cannot perform a dual function as a search peer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can add Standalone box B as search peer to Standalone box A. Again, it's not recommended that you have an indexer also work as search head (system B here) as it will increase load on that servers. Temporary this could work, but long term and to have robust SPlunk deployment, I would consider you reading these resources and re-architect your environment(s).
https://conf.splunk.com/session/2014/conf2014_KarandeepBains_Splunk_Deploying.pdf
http://docs.splunk.com/Documentation/Splunk/6.5.2/Capacity/Referencehardware
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You cannot chain your search heads but you can have Search Head A talk to both his own Indexer Tier A and also any other Indexer Tier. You simply login to Search Head A and go to Settings
-> Distributed Search
-> New
and add each Indexer from Tier B as a Search Peer. That's it. Now you are searching against both systems.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can add Standalone box B as search peer to Standalone box A. Again, it's not recommended that you have an indexer also work as search head (system B here) as it will increase load on that servers. Temporary this could work, but long term and to have robust SPlunk deployment, I would consider you reading these resources and re-architect your environment(s).
https://conf.splunk.com/session/2014/conf2014_KarandeepBains_Splunk_Deploying.pdf
http://docs.splunk.com/Documentation/Splunk/6.5.2/Capacity/Referencehardware
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the quick response.
