Deployment Architecture

Why can't I see indexes from the search head after enabling Index Clustering?

TerrySoucy
Explorer

Details:
- 3 x Indexers
- 1 x Cluster Master
- 1 x Search head
- 1 x Deployment server
- All running 6.2.0

I created the cluster master, then added each of my indexers as cluster peers. After copying my defaultIndexes app from the deployment server to the cluster master, I pushed the bundle out to the peers, then removed the defaultIndexes app from each indexer, as well as the deployment server (and reloaded). I then enabled index clustering on the search head (as a search head node) and disabled the indexers as search peers in the distributed search panel.

As soon as I disable the search peers, I am unable to search indexes in my cluster. I have additional search peers that are stand-alone (syslog servers) and I can search those indexes just fine, but I get 0 results when searching an index that is in the cluster. I found a similar topic on here that mentioned to add the indexes deployed in the config bundle as real indexes on the Cluster Master, but this gave the same result.

I'm not sure where else to look for this. Any ideas?

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...