Saved searches on multiple indexers

[jevenson]

We recently moved from one indexer to two indexers in a load balancing configuration. Both indexers are also acting as search heads. If I run a search on indexer A, it is able to pull data from indexer B with no problems.

I copied the savedsearches.conf to both indexers, as well as the dashboard xml file. Right now we can view the saved searches from either indexer, and run those searches. If I add a new search or dashboard on indexer A, how do I get it to show up in the Searches & Reports section on indexer B? For the life of me I can't figure that out, is it possible?

Also, semi-related to this is that all of the alerts that were working on the old indexer are now not working. You can run the search and see that the alerts should be sending an email, but it doesn't do anything. Is there some .conf file I'm missing?

Any ideas?

[Splunker · Accepted solution]

Sounds like you need to configure search-head pooling. Configuration details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling

[jevenson]

That's exactly what I was looking for. Thanks.
Any idea on why existing alerts are not sending emails? Any new alerts work just fine.