Deployment Architecture

Indexes not visible on searchhead

neltonk
Path Finder

Hi I have created a splunk cluster with the following configuration:

1 * Master (also the licensing master) - indexing turned off
3 * Inders peers
1 * Standalone search head - index turned off

I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
/ indexes.conf

I validated the bundle and on success applied to cluster. This created the index and app on the indexers. I have uploaded some data into the index. It is all green on the cluster dashboard but I cannot see the indexes on the searchhead. What should be done to view the indexes on the searchead. I am new to Splunk, have been asked to provision a splunk cluster... Please help.

Thanks,
Nelton

0 Karma

woodcock
Esteemed Legend

What do you mean by I cannot see? What exactly are you doing to see?

pradeepkumarg
Influencer

Did you add the cluster master to the search head to make the cluster searchable from search head?

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Enablethesearchhead

0 Karma

neltonk
Path Finder

This i done... when i click Distributed Environment -> Indexer clustering on the search head. I see the node listed as Search Head. The Cluster Master is listed under the section Clusters searched.

0 Karma

pradeepkumarg
Influencer

are you able to search internal data from the indexers? This to make sure communication is good between the search head and indexers?

second step is to make sure the data actually exists on the indexers. You can login to indexer GUI and go to settings indexes and see the event count or current size of the index.

Third step would be to make sure you are searching the data in the correct time range. If your time stamps are off, the data might be in a different time range than you are expecting.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...