Deployment Architecture
Highlighted

Splunk Deployment

Explorer

Hi ,

We are deploying Splunk in our environment and have been stuck up at a point.

We have deployed Indexer cluster in one network it consist of the following details
2 search head
4 indexer
Master node
Deployment server

Now our requirement is that we want to integrate one indexer present at a different site and network with the search head of the current cluster.

Is it possible and if so how can it be done ?

0 Karma
Highlighted

Re: Splunk Deployment

Legend

To integrate the other indexer in the search head you have only to insert it in the search peers list of each search head.
if you want to insert it also in the indexer cluster you have to follow the related procedure you already used for the other indexers.
remember that the old logs cannot be replicated.
bye.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: Splunk Deployment

Explorer

Hi ,

Thanks for your response, the solution provided seems to be helpful.However had a doubt regarding the license.
The separate indexer has its own license and my cluster has a different license would that seem to be clashing or would be working respectively.

0 Karma
Highlighted

Re: Splunk Deployment

Legend

Every Indexer uses own license, There aren't restrictions for the Search Heads.
In this way you can search logs from the same Search Heads both on the cluster and the separate Indexer.
Bye.
Giuseppe

0 Karma