Where should I create Summary Index in a Search Head Cluster?

[dhawal_sanghvi]

Hello,

I have a query. Where should I create the indexes for summary index data in the Search head clustering architecture? As of now, I have disabled index on the search head cluster members and forwarding the data to the search peers (indexers) by configuring the output.conf. So should I create the index on the search peers (indexers) OR Search head cluster members OR Search head Captain for the summary indexes so that data is available on the search head clustering?

Also, should I install the custom apps on the search peer (indexer) apart from the search head cluster through deployer?

Thanks,
Dhawal

[fabricebourel]

Hi there,

2 years late but never too late though as I have (had) the same question. There are several solutions but in a cluster context a best practice is to indeed forward summary indexes data to the indexer cluster layer. I invent nothing, I just read it here: https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Forwardsearchheaddata

• By forwarding the results of summary index searches to the indexer level, all search heads have access to them. Otherwise, they're only available to the search head that generates them.

A summary index is a regular index so it can be managed like any other index.

Cheers.

[andrey2007]

Hello, dhawal_sanghvi

According my experience, you should create summary indexes on both layers on search heads and on indexers.
If you create summary searches only using deployer it is not necessary to have indexes on search heads but in case of creating summary searches using web-interface it is necessary to have summary indexes on search head layer otherwise splunk can not find summary index to write summary data and will not allow save the search.

To manage indexers(search peers) you should use Cluster Master use Deployer only for Search Head management.
You can copy stanzas with your summary indexes from indexes.conf of search head layer (usually they are on deployer) and create custom app with these stanzas( or extend existing) on Cluster Master. So it is not necessary to do something special on Captain.