How do you make a Search Head talk to an Indexer?

[proletariat99]

Yeah, I realize this is a really ridiculous question, but I just can't seem to find the answer -- which I assume is really simple -- in splunk docs.

I have a single search head and a single indexer and I'm trying to get the search head to use the data from the indexer. Could someone please tell me in really simple terms what I need to do to access the data on the indexer from the search head?

[MuS]

Hi proletariat99,

How about the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Configuredistributedsearch where you get multiple ways to do it.

cheers, MuS

[mparks11 · Accepted solution]

Try this:

http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Configuredistributedsearch

[proletariat99]

Thanks man. The keywords I was missing was "Distributed Search." My google fu was all jacked up.

[ChrisG]

We have added some explanataion and a cross-reference in the Search Manual to help people find the right content: http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Whatsinthismanual Sorry you had this trouble!