Getting Data In

How do you make a Search Head talk to an Indexer?

Communicator

Yeah, I realize this is a really ridiculous question, but I just can't seem to find the answer -- which I assume is really simple -- in splunk docs.

I have a single search head and a single indexer and I'm trying to get the search head to use the data from the indexer. Could someone please tell me in really simple terms what I need to do to access the data on the indexer from the search head?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi proletariat99,

How about the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Configuredistributedsearch where you get multiple ways to do it.

cheers, MuS

Communicator

Thanks man. The keywords I was missing was "Distributed Search." My google fu was all jacked up.

Splunk Employee
Splunk Employee

We have added some explanataion and a cross-reference in the Search Manual to help people find the right content: http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Whatsinthismanual Sorry you had this trouble!

0 Karma