Getting Data In

How to map a custom App on a search head to a Remote Index on a indexer which is a separate physical server in a unclustered distributed deployment?

samhodgson
Path Finder

Hi,

I've created a custom app on my search head and want to map it to an index on my indexer which is a separate physical server in a distributed deployment(not clustered).

I am editing the indexes.conf in the app and dutifully pointing the homepath to $SPLUNK_DB/appname/db, however, it's not on the local filesystem. Does Splunk handle $SPLUNK_DB and realize this actually resides on a remote server? I haven't set $SPLUNK_DB in splunk-launch.conf so I believe it will default to $SPLUNK_HOME/var/lib/splunk which is a local path. Also nothing set in sys env vars.

env | grep SPLUNK
SPLUNK_HOME=/opt/splunk
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...