- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unable to fetch logs from Index in Search Head
Hello,
I have configured an index inside an indexer and when i try to fetch data from that index in search head not getting any data.
when i search that same index in indexer i could get the data from the index but not from search head.
Could you please assist what configuration needs to be checked on my search head and indexer ?
Note - it's not clustered setup.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @RAVISHANKAR ,
did you configured Distributed Search in Settings, configuring the Indexers for searching?
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
could you please explain a bit more in detail..
configured Distributed Search in Settings, configuring the Indexers for searching? - in indexer or in search head ??
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I hope you did the following configuration to connect search head with indexer. If not, then do it as mentioned below, else verify the configuration.
Configure the Indexer as a Search Peer
- Log in to the Splunk web interface on your search head.
- Go to Settings > Distributed Search > Search Peers.
- Click Add New to add a new search peer (indexer).
- Enter the management port (usually 8089) and the hostname or IP address of the indexer.
- If required, enter the username and password of the indexer to establish the connection.
- Click Save to add the indexer as a search peer.
------
If you find this solution helpful, please consider accepting it and awarding karma points !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gcusello - yes this is done and it showing as status up and replication was successfull.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gcusello - do we need to check anything else further ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have one indexer and inside that i have created one index and i couldn't fetch data of that index from search head but i can fetch it from the indexer.
Thanks
