Deployment Architecture
Highlighted

How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Builder

Hello guys,

I've setup a separated search head using distributed search with clustered indexers (in order to have a different portal with different authentication)

However if I select more than one indexer then I get duplicate events.

Any idea to search all indexers without duplicate events?

Thanks.

0 Karma
Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Legend

Hi realsplunk,
are you sure that you are sending events to your two indexers in auto load balancing and not in duplication?
verify it in outputs.conf file of your Universal Forwarder:
you are using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997, yyy.yyy.yyy.yyy:9997

you aren't using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997
[tcpout:stanza2]
server =  yyy.yyy.yyy.yyy:9997

Bye.
Giuseppe

View solution in original post

Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Builder

Hi cusello, auto load balancing is OK, there isn't duplicate events if I search on one of the clustered search heads, only on that new separated search head with distributed search.

[tcpout]
defaultGroup = ssl9997
useACK = true
maxQueueSize = 100MB
[tcpout:ssl
9997]
server = xxx01:9997, yyy01:9997
[tcpout-server://xxx01:9997]
sslCertPath=$SPLUNKHOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNK
HOME/etc/apps/APPOUTPUTS/local/cacert.pem
sslVerifyServerCert=false
[tcpout-server://yyy01:9997]
sslCertPath=$SPLUNK
HOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNKHOME/etc/apps/APPOUTPUTS/local/cacert.pem
sslVerifyServerCert=false

Thanks for your help.

0 Karma
Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Legend
Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Builder

It works, thanks a lot!

I kept 'standalone' mode on that search head and only search head role.

0 Karma
Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

SplunkTrust
SplunkTrust

Hi @realsplunk,

If you want to use standalone searchhead to search data from all clustered indexers without duplicate data then point your standalone search head to cluster master of Indexer cluster, do not add any indexer in Distributed search -> Search Peer.

When you will point standalone search head to cluster master of all indexer, Distibuted search -> Search Peer will be automatically updated with all indexers. Now when you search from this stand alone search head it will not display duplicate events from clustered indexers.

Thanks,
Harshil

Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

Builder

Thanks Harshil, do you mean I can add that cluster master (it's also our deployment server and is not indexing data) in distributed search or I must add the new search head in the cluster (which I don't want as i want separate authentication, customization...) ?

0 Karma
Highlighted

Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

SplunkTrust
SplunkTrust

Not Cluster master in Distributed Search but follow this URL http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Enablethesearchhead to point non-clustred search head to Cluster Master of Indexer cluster.

I am also running Cluster Search Head & Non clustered search head to same indexer cluster for different requirement.

0 Karma