Deployment Architecture

Saved searches on multiple indexers

jevenson
Path Finder

We recently moved from one indexer to two indexers in a load balancing configuration. Both indexers are also acting as search heads. If I run a search on indexer A, it is able to pull data from indexer B with no problems.

I copied the savedsearches.conf to both indexers, as well as the dashboard xml file. Right now we can view the saved searches from either indexer, and run those searches. If I add a new search or dashboard on indexer A, how do I get it to show up in the Searches & Reports section on indexer B? For the life of me I can't figure that out, is it possible?

Also, semi-related to this is that all of the alerts that were working on the old indexer are now not working. You can run the search and see that the alerts should be sending an email, but it doesn't do anything. Is there some .conf file I'm missing?

Any ideas?

Tags (1)
1 Solution

Splunker
Communicator

Sounds like you need to configure search-head pooling. Configuration details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling

View solution in original post

Splunker
Communicator

Sounds like you need to configure search-head pooling. Configuration details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling

jevenson
Path Finder

That's exactly what I was looking for. Thanks.
Any idea on why existing alerts are not sending emails? Any new alerts work just fine.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...