Deployment Architecture

Several search heads and several indexers WITHOUT replication is possible?

highsplunker
Contributor

Hey guys,
Several search heads and several indexers WITHOUT replication is possible?

I have several search heads "watching to" one indexer.
I would like to place an indexer in another Data Center: with NO replication functionality, but with possibility to search thru both indexers. Is it possible?

Search heads: v 6.5.2, v 7.2.3
Indexer: v 6.5.2

Labels (3)
1 Solution

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Hey @highsplunker, I see you like working with the community to solve splunk problems for FREE!

Can you please show the community some love in return by accepting an answer OR perhaps commenting further with why an answer proposed did not work for you?

This will help everyone understand that you respect their time and that it's in general FUN & REWARDING to interact with you.

We like watching everyone grow! However, when we don't know if we've helped it reduces our overall effectiveness as a FREE community support channel.

Cheers and thanks in advance for taking the short amount of time to accept answers that help!!!

0 Karma

highsplunker
Contributor

hi @jkat54 ,
you're probably right, my bad,
i will check my tickets once again!

cheers

rashid

jkat54
SplunkTrust
SplunkTrust

Hope you didn't get 30 emails as I updated my comment 😉 thanks mate!

0 Karma

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

highsplunker
Contributor

hi @waechtler_amasol !
thanks!
worked OK!

sorry for the delay! 🙂

best regards,
rashid

gcusello
SplunkTrust
SplunkTrust

Hi @highsplunker,
Yes, you can configure one (or more) Search Head to see more Indexers configuring them in [Settings -- Distributed Search -- Search Peers].
In this way you can search on all the configured Indexers.
Only one attention, try to align Splunk versions: there shouldn't be problems, but it isn't a best practice and 6.5.2 is very old!

Ciao.
Giuseppe

highsplunker
Contributor

hi @gcusello !
thanks a lot! you're right!
(sorry for the delay!)

best wishes,
rashid

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...