Getting Data In

Search Peers(Indexers) & what they get from their Mounted Knowledge Bundle

Ultra Champion

I'm setting up several Search Peers(Indexers) and a pool of Search Heads using the combined mount approach from the Splunk docs :

"For multiple search heads, you can
combine mounted bundles with search
head pooling. The pooled search heads
maintain one bundle on the shared
storage, and all search peers access
that bundle".

Will the Search Peers obtain their entire configuration from the mounted knowledge bundle, or just the knowledge pertaining to distributed search requests ?

ie: on each Search Peer do I also have to locally(or using Deploy Manager, Puppet etc..) setup the index definitions, index time transforms & receiving ?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

View solution in original post

Splunk Employee
Splunk Employee

They will only get information about distributed search requests from a mounted bundle. The other items must be configured locally as usual. Note that a mounted bundle will have the configuration from a search head, which will usually lack index definitions, listen ports, index-time transforms, etc.

View solution in original post

Ultra Champion

Thanks GK.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!