How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

[splunkreal]

Hello guys,

I've setup a separated search head using distributed search with clustered indexers (in order to have a different portal with different authentication)

However if I select more than one indexer then I get duplicate events.

Any idea to search all indexers without duplicate events?

Thanks.

[harsmarvania57]

Hi @realsplunk,

If you want to use standalone searchhead to search data from all clustered indexers without duplicate data then point your standalone search head to cluster master of Indexer cluster, do not add any indexer in Distributed search -> Search Peer.

When you will point standalone search head to cluster master of all indexer, Distibuted search -> Search Peer will be automatically updated with all indexers. Now when you search from this stand alone search head it will not display duplicate events from clustered indexers.

Thanks,
Harshil

[splunkreal]

Thanks Harshil, do you mean I can add that cluster master (it's also our deployment server and is not indexing data) in distributed search or I must add the new search head in the cluster (which I don't want as i want separate authentication, customization...) ?

[harsmarvania57]

Not Cluster master in Distributed Search but follow this URL http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Enablethesearchhead to point non-clustred search head to Cluster Master of Indexer cluster.

I am also running Cluster Search Head & Non clustered search head to same indexer cluster for different requirement.

[gcusello · Accepted solution]

Hi realsplunk,
are you sure that you are sending events to your two indexers in auto load balancing and not in duplication?
verify it in outputs.conf file of your Universal Forwarder:
you are using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997, yyy.yyy.yyy.yyy:9997

you aren't using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997
[tcpout:stanza2]
server =  yyy.yyy.yyy.yyy:9997

Bye.
Giuseppe

[splunkreal]

Hi cusello, auto load balancing is OK, there isn't duplicate events if I search on one of the clustered search heads, only on that new separated search head with distributed search.

[tcpout]
defaultGroup = ssl_9997
useACK = true
maxQueueSize = 100MB
[tcpout:ssl_9997]
server = xxx01:9997, yyy01:9997
[tcpout-server://xxx01:9997]
sslCertPath=$SPLUNK_HOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNK_HOME/etc/apps/APP_OUTPUTS/local/cacert.pem
sslVerifyServerCert=false
[tcpout-server://yyy01:9997]
sslCertPath=$SPLUNK_HOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNK_HOME/etc/apps/APP_OUTPUTS/local/cacert.pem
sslVerifyServerCert=false

Thanks for your help.

[gcusello]

Ok, see http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Enablethesearchhead

Bye.
Giuseppe

[splunkreal]

It works, thanks a lot!

I kept 'standalone' mode on that search head and only search head role.