Getting Data In

Searching across clustered and standalone indexers

606866581
Path Finder

Hi,
I've been reading related questions on this topic but I fear they're outdated as of 6.3.

Can I configure a search head to search across, say, 2 clusters and 2 standalone indexers?
I'm struggling to find documentation that confirms or disproves this possibility.

Thank you

EDIT : I should point out that we plan to use the 2 standalone indexers to manage the 2 clusters.

0 Karma
1 Solution

somesoni2
Revered Legend

The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...

Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch

View solution in original post

somesoni2
Revered Legend

The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...

Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch

606866581
Path Finder

I can't believe I missed it, It was right there! Thanks for your time

0 Karma

jmallorquin
Builder

Yes,

Just configure in the search peers in case of cluster one indexer of the cluster (to not duplicate events) and the standalone servers.

Hope i help you

0 Karma

606866581
Path Finder

I'm not sure how that would appear in server.conf. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch doesn't mention how standalone servers are taken into consideration.

0 Karma

jmallorquin
Builder

In the clusters how many servers do you have?

0 Karma

606866581
Path Finder

4, and each cluster will be managed by the 2 standalone indexers. This adds another level of complexity unfortunately

0 Karma

jmallorquin
Builder

And the replication factor?

0 Karma

606866581
Path Finder

2, search factor 2. But would this make a difference?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...