Yeah, I realize this is a really ridiculous question, but I just can't seem to find the answer -- which I assume is really simple -- in splunk docs.
I have a single search head and a single indexer and I'm trying to get the search head to use the data from the indexer. Could someone please tell me in really simple terms what I need to do to access the data on the indexer from the search head?
How about the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Configuredistributedsearch where you get multiple ways to do it.
Thanks man. The keywords I was missing was "Distributed Search." My google fu was all jacked up.
We have added some explanataion and a cross-reference in the Search Manual to help people find the right content: http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Whatsinthismanual Sorry you had this trouble!