Deployment Architecture

Search head does not send search to all search peers

termcap
Path Finder

Hi,

My design:

 

1. Search Head: splunk-sh
2. My search peers: splunk-idx1 and splunk-idx2
3. My forwarders: splunk-fw1 and splunk-fw2

 

 

My Data Flow:

 

splunk-fw1 -> sends data -> splunk-idx1 into index mail
splunk-fw2 -> sends data -> splunk-idx2 into index mess

IMP NOTE: index mail only exists on splunk-idx1 and index mess only exists on splunk-idx2

 

 

My Search on the search head:

 

index="mess"

 

When I run the above search I am expecting the search head to send the search to both the search peers, splunk-idx1 and splunk-idx2 but I find that Splunk, quiet intelligently, only sends the search to the search peer that has the index mess and does not send it to the other search peer.

Is this by design ?

Another question. Is it a valid architecture to not have the same indexes on all the search peers because I just want a single querying interface(search head) but at the same time I want to spread the data onto multiple indexers.

 

Thanks,

Termcap

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

that’s the way how it has planned to work. You could look more details from job inspector.

It’s ok to do it that way. If you are needing high availability, then your should jump to indexer clustering. That’s also give more performance when you have more peers in cluster. 

https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Aboutindexesandindexers

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

that’s the way how it has planned to work. You could look more details from job inspector.

It’s ok to do it that way. If you are needing high availability, then your should jump to indexer clustering. That’s also give more performance when you have more peers in cluster. 

https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Aboutindexesandindexers

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...