Getting Data In

How to move a summary index from a search head to the indexers?

Glasses
Builder

Hi
I don't have a lot of experience with summary indexes, but the previous admin created some schedule reports and set summary indexing to an index on the local search head box.

I have to decom this physical server and move the searchhead to the cloud, so I will tar it and move it.

But I don't want the summary index - indexing locally to an instance that is a dedicated searchhead...

Please advise how I can configure the summary to send to the indexers (which are non-clustered, autolb).
Thank you

0 Karma
1 Solution

Glasses
Builder

Thank you, one quick follow up,
do I create these confs in system/local or in the search app or launcher app where I find the base schedule searches... not sure which directory to insert those...

Thanks

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...