- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Several search heads and several indexers WITHOUT ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey guys,
Several search heads and several indexers WITHOUT replication is possible?
I have several search heads "watching to" one indexer.
I would like to place an indexer in another Data Center: with NO replication functionality, but with possibility to search thru both indexers. Is it possible?
Search heads: v 6.5.2, v 7.2.3
Indexer: v 6.5.2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, a searchhead can search through more than one indexer
On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added
You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey @highsplunker, I see you like working with the community to solve splunk problems for FREE!
Can you please show the community some love in return by accepting an answer OR perhaps commenting further with why an answer proposed did not work for you?
This will help everyone understand that you respect their time and that it's in general FUN & REWARDING to interact with you.
We like watching everyone grow! However, when we don't know if we've helped it reduces our overall effectiveness as a FREE community support channel.
Cheers and thanks in advance for taking the short amount of time to accept answers that help!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @jkat54 ,
you're probably right, my bad,
i will check my tickets once again!
cheers
rashid
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hope you didn't get 30 emails as I updated my comment 😉 thanks mate!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, a searchhead can search through more than one indexer
On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added
You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @waechtler_amasol !
thanks!
worked OK!
sorry for the delay! 🙂
best regards,
rashid
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @highsplunker,
Yes, you can configure one (or more) Search Head to see more Indexers configuring them in [Settings -- Distributed Search -- Search Peers].
In this way you can search on all the configured Indexers.
Only one attention, try to align Splunk versions: there shouldn't be problems, but it isn't a best practice and 6.5.2 is very old!
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @gcusello !
thanks a lot! you're right!
(sorry for the delay!)
best wishes,
rashid
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
