Deployment Architecture

Problem accessing the indexes from the indexer with one master and one search head

negast
New Member

Hello,

So, I'm trying to produce the following topology where I have one master/search head and one separate indexer.
I've set up the master and indexer. Data is being forwarded to the indexer and the indexer has it's indexes configured. The master is also configured to send all it's data to the indexer.

The problem now is that I can't access the indexes from the indexer with search except for the internal ones.
Is it possible to search on the other indexes without defining them in the master, or do I also need to recreate them there?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi negast,
just a little additional information:

  • when you say "master" are you speaking about "Master License"?
  • had you configured in your Search Head the distributed Search and your indexer as Search Peer?
  • can you see Indexer's not internal logs from Indexer?

Probably you have to review your distributed search configuration (see at https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/Whatisdistributedsearch ).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...