Getting Data In

How to add and configure a new indexer to my Splunk environment?

ppanchal
Path Finder

Hi, I am new to Splunk and I am planning to add an indexer to our Splunk enterprise environment.
We already have 2 indexers, a search head and a deployment server.

Can somebody please assist me with the docs/steps to install/add a new indexer?

The operating system that we are using is Linux.

Any help is much appreciated.

muscafe
Explorer

Hello,

i try to add the indexer in cli to my search Head via :

/opt/splunk/bin/splunk add search-server 192.168.44.148:8089 -remoteUsername *-remotePassword ****

it results this errror :

Your session is invalid. Please login.
Splunk username:

Can you tell me please what's the problem and what's splunk talking about!
Thks

0 Karma

gcusello
SplunkTrust
SplunkTrust

If you have not clustered indexers, it's very easy:
- install Splunk on the new server,
- add to your search head a new search peer [Settings -- Distributed Search -- Search peer]
- modify outputs.conf of your forwarders to send logs also to the new Indexer: it's easy if you manage outputs.conf using Deployment server, because you have to modify it in only one point, if not, it's more difficult because you have to manually modify outputs.conf in all forwarders .
You can have instructions how to modify outputs.conf at http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Configureforwardingwithoutputs.conf

Otherwise, if you have clustered indexers (I don't think because you didn't speak about a Master Node!) see and follow http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/Clusterdeploymentoverview because it's more complicated.

Bye.
Giuseppe

ppanchal
Path Finder

Thanks, I will try this.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Did you tried?
if you're satisfied by this answer please accept or upvote it.
Bye.
Giuseppe

0 Karma

muscafe
Explorer

Hello Giuseppe,
thank you fior your answer!
i have a problem with my certificat because my indexer have not a similaire certificat fo th Search Head!
and it's verry inportant to add the default Port to splunk in the Fierwall!
Have a good week

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...