How to add and configure a new indexer to my Splunk environment?

[ppanchal]

Hi, I am new to Splunk and I am planning to add an indexer to our Splunk enterprise environment.
We already have 2 indexers, a search head and a deployment server.

Can somebody please assist me with the docs/steps to install/add a new indexer?

The operating system that we are using is Linux.

Any help is much appreciated.

[muscafe]

Hello,

i try to add the indexer in cli to my search Head via :

/opt/splunk/bin/splunk add search-server 192.168.44.148:8089 -remoteUsername *-remotePassword ****

it results this errror :

Your session is invalid. Please login.
Splunk username:

Can you tell me please what's the problem and what's splunk talking about!
Thks

[gcusello]

If you have not clustered indexers, it's very easy:
- install Splunk on the new server,
- add to your search head a new search peer [Settings -- Distributed Search -- Search peer]
- modify outputs.conf of your forwarders to send logs also to the new Indexer: it's easy if you manage outputs.conf using Deployment server, because you have to modify it in only one point, if not, it's more difficult because you have to manually modify outputs.conf in all forwarders .
You can have instructions how to modify outputs.conf at http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Configureforwardingwithoutputs.conf

Otherwise, if you have clustered indexers (I don't think because you didn't speak about a Master Node!) see and follow http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/Clusterdeploymentoverview because it's more complicated.

Bye.
Giuseppe

[ppanchal]

Thanks, I will try this.

[gcusello]

Did you tried?
if you're satisfied by this answer please accept or upvote it.
Bye.
Giuseppe

[muscafe]

Hello Giuseppe,
thank you fior your answer!
i have a problem with my certificat because my indexer have not a similaire certificat fo th Search Head!
and it's verry inportant to add the default Port to splunk in the Fierwall!
Have a good week