Deployment Architecture

Why does adding search peer make searches time out/fail?

pc1
Path Finder

Hello,

I am trying to add a search peer to our existing environment in order to scale it up a bit. The main instance is Splunk Enterprise which acts as the search head, indexer, and everything else pretty much. When I add the second Splunk Enterprise server that I set up as a peer under Distributed Search > Search Peers, everything stops working essentially on the main instance. Searches will never load and everything is extremely slow. This is when I add the 2nd new server as a peer on the main instance. I've tried adding it both ways and/or enabled on both but nothing seems to work. 

My initial thoughts are maybe because the main instance isn't divided into multiple parts like a separate server for a search head, and then have the two indexers under that - but that seems much more complicated to set up than I want. Just looking to add a peer as another indexer type server to expand a bit.

Any thoughts are appreciated

Thanks 

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my proposal is to add at least two nodes. One additional peer and second one as a search head and a license master. Then “move” your original all in one box to second peer. Even better if you could move your current peer with another peer and cm as an indexer cluster. 

if you cannot do that way, then look splunkd.log what errors or warnings you could found.


r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...