Deployment Architecture

Indexes not visible on searchhead

neltonk
Path Finder

Hi I have created a splunk cluster with the following configuration:

1 * Master (also the licensing master) - indexing turned off
3 * Inders peers
1 * Standalone search head - index turned off

I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
/ indexes.conf

I validated the bundle and on success applied to cluster. This created the index and app on the indexers. I have uploaded some data into the index. It is all green on the cluster dashboard but I cannot see the indexes on the searchhead. What should be done to view the indexes on the searchead. I am new to Splunk, have been asked to provision a splunk cluster... Please help.

Thanks,
Nelton

0 Karma

woodcock
Esteemed Legend

What do you mean by I cannot see? What exactly are you doing to see?

pradeepkumarg
Influencer

Did you add the cluster master to the search head to make the cluster searchable from search head?

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Enablethesearchhead

0 Karma

neltonk
Path Finder

This i done... when i click Distributed Environment -> Indexer clustering on the search head. I see the node listed as Search Head. The Cluster Master is listed under the section Clusters searched.

0 Karma

pradeepkumarg
Influencer

are you able to search internal data from the indexers? This to make sure communication is good between the search head and indexers?

second step is to make sure the data actually exists on the indexers. You can login to indexer GUI and go to settings indexes and see the event count or current size of the index.

Third step would be to make sure you are searching the data in the correct time range. If your time stamps are off, the data might be in a different time range than you are expecting.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!