Deployment Architecture

How to connect search head to new indexer in a distributed environment (beginner here)

maxguttsait
New Member

Hi all,

Currently, our Splunk dev environment consists of a standalone instance that is both our indexer and search head.
What I am trying to do is set up a new search head that will connect to our production environment indexer, essentially mimicking production in development. I have a brand new instance that I just got set up that will act as a standalone search head.
From here, would I add the indexer as a search peer in a distributed search?
I'm only about a week into learning Splunk, so this stuff definitely confuses me a bit which is why I decided to ask on here.

Please let me know what you guys think is the best solution here.

0 Karma

sandeepmakkena
Contributor

Use the CLI
To add a search peer, run this command from the search head:

splunk add search-server ://: -auth : -remoteUsername -remotePassword

Note the following:

  1. is the URI scheme: "http" or "https".
  2. is the host name or IP address of the search peer's host machine.
  3. is the management port of the search peer.
  4. Use the -auth flag to provide credentials for the search head.
  5. Use the -remoteUsername and -remotePassword flags for the credentials for the search peer. The
    remote credentials must be for an admin-level user on the search peer.

    For example:

    splunk add search-server https://192.168.1.1:8089 -auth admin:password -remoteUsername admin -remotePassword passremote
    You must run this command for each search peer that you want to add.

https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Configuredistributedsearch

You can refer to the above link.

Hope this help, Thanks !

richgalloway
SplunkTrust
SplunkTrust

You have it right. Go to Settings->Distributed search and add the existing indexer as a search peer.
Keep in mind that every search run on the two search heads takes up a CPU on the indexer so be careful not to allow Dev to affect the performance of Prod by running a lot of searches and using up resources on the indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...