Getting Data In

How to enable this standalone search head(SH) to search data in a clustered SH/indexer?

krusovice
Path Finder

Hi all,

I have the distributed environment setup for SH cluster and indexer cluster.

Now, I have a standalone server with both SH and indexer configured. My question is how to enable this standalone server to search the data ingested to distributed/clustered environment?

I just want to enable the search in standalone server, and I don't want to have the data inside standalone server, and I don't want to add standalone as one of the SH cluster.

Is this doable? I'm trying to read the documentation but kind of confusing after reading and I have no idea which document is the right doc for such requirement.

Thanks.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Yes, it is doable.

A search head can search multiple indexers. It can also search multiple indexer clusters. Here's one answer that talks about that...

https://answers.splunk.com/answers/65766/configure-one-search-head-to-search-multiple-clusters-each-...

Annnnddd.... here's the specific page with careful instructions for what you are asking...

https://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configureclusteredandnonclusteredsearch

The search head will have a distsearch.conf file with the unclustered indexers in it, and server.conf with the cluster master described in it for the clustered indexers.

Please read the description carefully, at least three times before you touch the keyboard.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hello @krusovice . Were you able to test out @DalJeanis 's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes, it is doable.

A search head can search multiple indexers. It can also search multiple indexer clusters. Here's one answer that talks about that...

https://answers.splunk.com/answers/65766/configure-one-search-head-to-search-multiple-clusters-each-...

Annnnddd.... here's the specific page with careful instructions for what you are asking...

https://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configureclusteredandnonclusteredsearch

The search head will have a distsearch.conf file with the unclustered indexers in it, and server.conf with the cluster master described in it for the clustered indexers.

Please read the description carefully, at least three times before you touch the keyboard.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...