Deployment Architecture

unable to fetch data from distributed search peers


Hi Splunkers,

Have 2indexers(indexer1 and indexer2) as distributed search peers.
logs are showing up on indexers(2) UI but not on SH

SH is fetching the data from only indexer1.
1.Data is available on both the indexers.
2. Indexer2 and Search head are communicating.
3. Splunk status(splunkd and web) are running.

Thanks in advance.

0 Karma


weird Troubleshooting:
Restart the Search head. 🙂

Splunk Employee
Splunk Employee

Are you running in a Cluster configuration, or distributed peer configuration?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...