Splunk Deployment

[himapate]

Hi ,

We are deploying Splunk in our environment and have been stuck up at a point.

We have deployed Indexer cluster in one network it consist of the following details
2 search head
4 indexer
Master node
Deployment server

Now our requirement is that we want to integrate one indexer present at a different site and network with the search head of the current cluster.

Is it possible and if so how can it be done ?

[gcusello · Accepted solution]

To integrate the other indexer in the search head you have only to insert it in the search peers list of each search head.
if you want to insert it also in the indexer cluster you have to follow the related procedure you already used for the other indexers.
remember that the old logs cannot be replicated.
bye.
Giuseppe

[himapate]

Hi ,

Thanks for your response, the solution provided seems to be helpful.However had a doubt regarding the license.
The separate indexer has its own license and my cluster has a different license would that seem to be clashing or would be working respectively.

[gcusello]

Every Indexer uses own license, There aren't restrictions for the Search Heads.
In this way you can search logs from the same Search Heads both on the cluster and the separate Indexer.
Bye.
Giuseppe