Deployment Architecture

Several search heads and several indexers WITHOUT replication is possible?

highsplunker
Contributor

Hey guys,
Several search heads and several indexers WITHOUT replication is possible?

I have several search heads "watching to" one indexer.
I would like to place an indexer in another Data Center: with NO replication functionality, but with possibility to search thru both indexers. Is it possible?

Search heads: v 6.5.2, v 7.2.3
Indexer: v 6.5.2

Labels (3)
1 Solution

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Hey @highsplunker, I see you like working with the community to solve splunk problems for FREE!

Can you please show the community some love in return by accepting an answer OR perhaps commenting further with why an answer proposed did not work for you?

This will help everyone understand that you respect their time and that it's in general FUN & REWARDING to interact with you.

We like watching everyone grow! However, when we don't know if we've helped it reduces our overall effectiveness as a FREE community support channel.

Cheers and thanks in advance for taking the short amount of time to accept answers that help!!!

0 Karma

highsplunker
Contributor

hi @jkat54 ,
you're probably right, my bad,
i will check my tickets once again!

cheers

rashid

jkat54
SplunkTrust
SplunkTrust

Hope you didn't get 30 emails as I updated my comment 😉 thanks mate!

0 Karma

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

highsplunker
Contributor

hi @waechtler_amasol !
thanks!
worked OK!

sorry for the delay! 🙂

best regards,
rashid

gcusello
SplunkTrust
SplunkTrust

Hi @highsplunker,
Yes, you can configure one (or more) Search Head to see more Indexers configuring them in [Settings -- Distributed Search -- Search Peers].
In this way you can search on all the configured Indexers.
Only one attention, try to align Splunk versions: there shouldn't be problems, but it isn't a best practice and 6.5.2 is very old!

Ciao.
Giuseppe

highsplunker
Contributor

hi @gcusello !
thanks a lot! you're right!
(sorry for the delay!)

best wishes,
rashid

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...