Deployment Architecture

How to connect search head to new indexer in a distributed environment (beginner here)

maxguttsait
New Member

Hi all,

Currently, our Splunk dev environment consists of a standalone instance that is both our indexer and search head.
What I am trying to do is set up a new search head that will connect to our production environment indexer, essentially mimicking production in development. I have a brand new instance that I just got set up that will act as a standalone search head.
From here, would I add the indexer as a search peer in a distributed search?
I'm only about a week into learning Splunk, so this stuff definitely confuses me a bit which is why I decided to ask on here.

Please let me know what you guys think is the best solution here.

0 Karma

sandeepmakkena
Contributor

Use the CLI
To add a search peer, run this command from the search head:

splunk add search-server ://: -auth : -remoteUsername -remotePassword

Note the following:

  1. is the URI scheme: "http" or "https".
  2. is the host name or IP address of the search peer's host machine.
  3. is the management port of the search peer.
  4. Use the -auth flag to provide credentials for the search head.
  5. Use the -remoteUsername and -remotePassword flags for the credentials for the search peer. The
    remote credentials must be for an admin-level user on the search peer.

    For example:

    splunk add search-server https://192.168.1.1:8089 -auth admin:password -remoteUsername admin -remotePassword passremote
    You must run this command for each search peer that you want to add.

https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Configuredistributedsearch

You can refer to the above link.

Hope this help, Thanks !

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have it right. Go to Settings->Distributed search and add the existing indexer as a search peer.
Keep in mind that every search run on the two search heads takes up a CPU on the indexer so be careful not to allow Dev to affect the performance of Prod by running a lot of searches and using up resources on the indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...