How do you search for all data on one index server in a cluster?

[broberg]

We got a large Splunk distributed environment and for troubleshooting i want to search for all data in only one index server and not on the cluster.

I don't want the search or a search request to go to any of there other index servers.

Is this possible?

[dkeck · Accepted solution]

Hi,

just add a splunk_server=your indexer name

e.g. index=_internal splunk_server=your indexer name

to your search

[dkeck]

Any luck with that?

If it helped please accept the answer 🙂 Thank you

[broberg]

Hi, yes that actually worked. I thought it would send the search to all index servers but it actually did not. Thank you.