Getting Data In
Highlighted

How to add and configure a new indexer to my Splunk environment?

Path Finder

Hi, I am new to Splunk and I am planning to add an indexer to our Splunk enterprise environment.
We already have 2 indexers, a search head and a deployment server.

Can somebody please assist me with the docs/steps to install/add a new indexer?

The operating system that we are using is Linux.

Any help is much appreciated.

Highlighted

Re: How to add and configure a new indexer to my Splunk environment?

Legend

If you have not clustered indexers, it's very easy:
- install Splunk on the new server,
- add to your search head a new search peer [Settings -- Distributed Search -- Search peer]
- modify outputs.conf of your forwarders to send logs also to the new Indexer: it's easy if you manage outputs.conf using Deployment server, because you have to modify it in only one point, if not, it's more difficult because you have to manually modify outputs.conf in all forwarders .
You can have instructions how to modify outputs.conf at http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Configureforwardingwithoutputs.conf

Otherwise, if you have clustered indexers (I don't think because you didn't speak about a Master Node!) see and follow http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/Clusterdeploymentoverview because it's more complicated.

Bye.
Giuseppe

Highlighted

Re: How to add and configure a new indexer to my Splunk environment?

Path Finder

Thanks, I will try this.

0 Karma
Highlighted

Re: How to add and configure a new indexer to my Splunk environment?

Legend

Did you tried?
if you're satisfied by this answer please accept or upvote it.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How to add and configure a new indexer to my Splunk environment?

Explorer

Hello Giuseppe,
thank you fior your answer!
i have a problem with my certificat because my indexer have not a similaire certificat fo th Search Head!
and it's verry inportant to add the default Port to splunk in the Fierwall!
Have a good week

0 Karma
Highlighted

Re: How to add and configure a new indexer to my Splunk environment?

Explorer

Hello,

i try to add the indexer in cli to my search Head via :

/opt/splunk/bin/splunk add search-server 192.168.44.148:8089 -remoteUsername *-remotePassword ****

it results this errror :

Your session is invalid. Please login.
Splunk username:

Can you tell me please what's the problem and what's splunk talking about!
Thks

0 Karma