Getting Data In

Search head looks at cluster and separate index

jerrythoms
Explorer

In the middle of creating a new environment with an index cluster. On our current setup we have just one indexer. Is it possible to configure the new search head to search both the old indexer and new cluster when a search is preformed? without changing any settings on the old indexer as it is still in use.

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi jerrythoms,
yes it's possible.
You have to separately configure in [Settings -- Distributed Search] the stand alone Indexers and the cluster.
Anyway there isn't any setting on Indexers, only on Search Head.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi jerrythoms,
yes it's possible.
You have to separately configure in [Settings -- Distributed Search] the stand alone Indexers and the cluster.
Anyway there isn't any setting on Indexers, only on Search Head.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...