Getting Data In

Can a Search Head outside of a Search Head Cluster use the same indexers?

Explorer

In my company we set up our Splunk to use a Search Head Cluster and a Indexer Cluster but I want to make a separate Splunk instance (not in the sh-cluster) use the indexers. This is meant to be a "developers" instance and I want to keep the environment to a minimum by opting out of things like shcluster redeploys, bundle replication, scheduled searches, etc...

Is there a way to configure a search head to work like this?

0 Karma
1 Solution

Revered Legend

It certainly is possible. Use steps from following link to setup a search head to use indexer cluster peers.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurethesearchhead

Please be aware that having a Development instance querying a Production Indexer cluster will cause additional load on the Indexers, as well as there might be a risk where developer may accidentally delete prod data, so keep a close control on access if you really have to implement this way.

View solution in original post

0 Karma

Revered Legend

It certainly is possible. Use steps from following link to setup a search head to use indexer cluster peers.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurethesearchhead

Please be aware that having a Development instance querying a Production Indexer cluster will cause additional load on the Indexers, as well as there might be a risk where developer may accidentally delete prod data, so keep a close control on access if you really have to implement this way.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!