Deployment Architecture

How to integrate a multisite indexer cluster with remote standalone Splunk installations?

gfreitas
Builder

Dear Splunkers,

We have a multisite Indexer Cluster in our datacenter and some remote locations with local standalone Splunk installations. Now we want to connect our search heads of the datacenters to those remote Splunk installations. It's important for us to use Splunk Search Group of search peers because we just want to search those remote Splunk installations when needed to save bandwidth. I saw on distsearch documentation that we cannot use cluster and search group functions at the same time. Does anyone know how can I integrate those two Splunk installations?

Thanks!

0 Karma

renjith_nair
Legend

You can search across both clustered and non-clustered search peers

  1. Configure an indexer cluster search head in the standard fashion
  2. Use Splunk Web or the CLI to add one or more non-clustered search peers

Details are here : http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Configureclusteredandnonclusteredsearch

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

gfreitas
Builder

Hi renjith.nair,

Thanks for your answer but this don't let me use the search group: http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/Distributedsearchgroups. I need to create a search group because I don't want to search those standalone splunk by default just when I explicitly want.

thanks!

0 Karma

renjith_nair
Legend

We do have mixed configuration but never tried search group.
One possibility is that to set up a small standalone instance on your main site(dummy) and add it also as distsearch. Then create two groups with main and remote in each group and make main as default=true.

Other possibility is to add the search head as peer inside the configuration . It's not tested and not sure if it works as we expected

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...