Deployment Architecture

Which Add Data button should I use to import data into a clustered index?

mpulis8966
Explorer

In our Splunk Enterprise Environment, we have 3 search heads, 7 indexers, and a cluster master.

If we wanted to use the "Add Data" button to import a log file into a clustered index, where should I use the "Add Data" button?

Cluster Master?

Search head?

One of the indexers and it will distribute it to the other indexes?

0 Karma
1 Solution

mpulis8966
Explorer

Looks like the Answer is Any Clustered Indexer UI will import the data into the indexes using the Add Data Button

If you want to import multiple files you can upload the files to one of the indexers , log into that indexers UI and use the monitor folder option for add data

if you want to use your id rather than admin be sure you have the "edit_indexes" role under “capabilities” section.

View solution in original post

0 Karma

mpulis8966
Explorer

Looks like the Answer is Any Clustered Indexer UI will import the data into the indexes using the Add Data Button

If you want to import multiple files you can upload the files to one of the indexers , log into that indexers UI and use the monitor folder option for add data

if you want to use your id rather than admin be sure you have the "edit_indexes" role under “capabilities” section.

0 Karma

mpulis8966
Explorer

Splunk v6.3.2

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...