Getting Data In

Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

Damien_Dallimor
Ultra Champion

I'm setting up several Search Peers(Indexers) and a pool of Search Heads using the combined mount approach from the Splunk docs :

"For multiple search heads, you can
combine mounted bundles with search
head pooling. The pooled search heads
maintain one bundle on the shared
storage, and all search peers access
that bundle".

Will the Search Peers obtain their entire configuration from the mounted knowledge bundle, or just the knowledge pertaining to distributed search requests ?

ie: on each Search Peer do I also have to locally(or using Deploy Manager, Puppet etc..) setup the index definitions, index time transforms & receiving ?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

Damien_Dallimor
Ultra Champion

Thanks GK.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...