Deployment Architecture

Multiple search heads, one indexer

smileyge
Path Finder

Is it possible to set up several search heads to search the same index if, say, I wanted a particular search head to only search an index or two, and leave the other one searching all indexes. I would not add another indexer.

Tags (2)

lpolo
Motivator

Yes. It is possible to define the specific search peers you need in each search head.
More information:

http://docs.splunk.com/Documentation/Splunk/6.1.1/DistSearch/Configuredistributedsearch

Thanks,
Lp

lpolo
Motivator

Each indexer and search head has its own license configuration. If you are using a license server all the indexers and search heads has to point to the same license server. If you have 2 license servers, you could have a set of indexers and search heads pointing to one license server and the other set pointing to the other license server.
More information about license server:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/HowSplunklicensingworks

0 Karma

smileyge
Path Finder

I have seen that as well as the docs on search pools, so thanks for helping me understand which one I want. When adding a peer, what license file is used and does replicating the data consume license volume?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...