Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

[Damien_Dallimor]

I'm setting up several Search Peers(Indexers) and a pool of Search Heads using the combined mount approach from the Splunk docs :

"For multiple search heads, you can
combine mounted bundles with search
head pooling. The pooled search heads
maintain one bundle on the shared
storage, and all search peers access
that bundle".

Will the Search Peers obtain their entire configuration from the mounted knowledge bundle, or just the knowledge pertaining to distributed search requests ?

ie: on each Search Peer do I also have to locally(or using Deploy Manager, Puppet etc..) setup the index definitions, index time transforms & receiving ?

[gkanapathy · Accepted solution]

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

[Damien_Dallimor]

Thanks GK.