Getting Data In

Can a Search Head outside of a Search Head Cluster use the same indexers?

matutter4
Explorer

In my company we set up our Splunk to use a Search Head Cluster and a Indexer Cluster but I want to make a separate Splunk instance (not in the sh-cluster) use the indexers. This is meant to be a "developers" instance and I want to keep the environment to a minimum by opting out of things like shcluster redeploys, bundle replication, scheduled searches, etc...

Is there a way to configure a search head to work like this?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

It certainly is possible. Use steps from following link to setup a search head to use indexer cluster peers.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurethesearchhead

Please be aware that having a Development instance querying a Production Indexer cluster will cause additional load on the Indexers, as well as there might be a risk where developer may accidentally delete prod data, so keep a close control on access if you really have to implement this way.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It certainly is possible. Use steps from following link to setup a search head to use indexer cluster peers.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurethesearchhead

Please be aware that having a Development instance querying a Production Indexer cluster will cause additional load on the Indexers, as well as there might be a risk where developer may accidentally delete prod data, so keep a close control on access if you really have to implement this way.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...