Unable to fetch logs from Index in Search Head

[RAVISHANKAR]

Hello,

I have configured an index inside an indexer and when i try to fetch data from that index in search head not getting any data.

when i search that same index in indexer i could get the data from the index but not from search head.

Could you please assist what configuration needs to be checked on my search head and indexer ?

Note - it's not clustered setup.

Thanks

[gcusello]

Hi @RAVISHANKAR ,

did you configured Distributed Search in Settings, configuring the Indexers for searching?

Ciao.

Giuseppe

[RAVISHANKAR]

@gcusello  -

could you please explain a bit more in detail..

configured Distributed Search in Settings, configuring the Indexers for searching? - in indexer or in search head ??

Thanks

[Jawahir]

I hope you did the following configuration to connect search head with indexer. If not, then do it as mentioned below, else verify the configuration.

Configure the Indexer as a Search Peer

• Log in to the Splunk web interface on your search head.
• Go to Settings > Distributed Search > Search Peers.
• Click Add New to add a new search peer (indexer).
• Enter the management port (usually 8089) and the hostname or IP address of the indexer.
• If required, enter the username and password of the indexer to establish the connection.
• Click Save to add the indexer as a search peer.

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[RAVISHANKAR]

@gcusello - yes this is done and it showing as status up and replication was successfull.

Thanks

[RAVISHANKAR]

@gcusello - do we need to check anything else further ??

[gcusello]

Hi @RAVISHANKAR ,

can you access other indexes or not?

Ciao.

Giuseppe

[RAVISHANKAR]

@gcusello 

I have one indexer and inside that i have created one index and i couldn't fetch data of that index from search head but i can fetch it from the indexer.

Thanks