Deployment Architecture

Indexes not visible on searchhead

neltonk
Path Finder

Hi I have created a splunk cluster with the following configuration:

1 * Master (also the licensing master) - indexing turned off
3 * Inders peers
1 * Standalone search head - index turned off

I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
/ indexes.conf

I validated the bundle and on success applied to cluster. This created the index and app on the indexers. I have uploaded some data into the index. It is all green on the cluster dashboard but I cannot see the indexes on the searchhead. What should be done to view the indexes on the searchead. I am new to Splunk, have been asked to provision a splunk cluster... Please help.

Thanks,
Nelton

0 Karma

woodcock
Esteemed Legend

What do you mean by I cannot see? What exactly are you doing to see?

pradeepkumarg
Influencer

Did you add the cluster master to the search head to make the cluster searchable from search head?

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Enablethesearchhead

0 Karma

neltonk
Path Finder

This i done... when i click Distributed Environment -> Indexer clustering on the search head. I see the node listed as Search Head. The Cluster Master is listed under the section Clusters searched.

0 Karma

pradeepkumarg
Influencer

are you able to search internal data from the indexers? This to make sure communication is good between the search head and indexers?

second step is to make sure the data actually exists on the indexers. You can login to indexer GUI and go to settings indexes and see the event count or current size of the index.

Third step would be to make sure you are searching the data in the correct time range. If your time stamps are off, the data might be in a different time range than you are expecting.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...