Getting Data In

How to map a custom App on a search head to a Remote Index on a indexer which is a separate physical server in a unclustered distributed deployment?

samhodgson
Path Finder

Hi,

I've created a custom app on my search head and want to map it to an index on my indexer which is a separate physical server in a distributed deployment(not clustered).

I am editing the indexes.conf in the app and dutifully pointing the homepath to $SPLUNK_DB/appname/db, however, it's not on the local filesystem. Does Splunk handle $SPLUNK_DB and realize this actually resides on a remote server? I haven't set $SPLUNK_DB in splunk-launch.conf so I believe it will default to $SPLUNK_HOME/var/lib/splunk which is a local path. Also nothing set in sys env vars.

env | grep SPLUNK
SPLUNK_HOME=/opt/splunk
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.