Summary indexeing in Distributed Search environment

[linu1988]

Hello,
I was planning for summary indexing. I did two custom indexes and ran the searches. After couple of days i remembered that i should create those indexes in the indexers rather than in search head for better maintainability. I created the indexes in indexers and remove the original from the search head.

Now when i try to assign them in savedsearch now they show up but give me error that the indexes don't exist!!! What do i need to do now, any one has any experience with it?

Thanks in advance.

[linu1988]

i have done the same, still it stores data only in search head. not in indexer

[linu1988]

you guessed right, i will give it a try tomorrow and let you know the result if it really re-directs to indexers only. Thanks

[sloshburch]

Agree with linu1988 - To work around this same challenge, we have a master indexes.conf in a customer app that the deployment server sends to all of the indexers and the search heads. It allows the indexes to show up in the UI but given that the forwarders only send data to the indexers I don't have to worry about the Search Heads having any data.

[sloshburch]

Simply turn on forwarding on the search heads in the same fashion as you would for any heavy forwarder. Take a peek in the splunk documentation for this one.

Cool?

[linu1988]

how do i forward the index from search head to indexer? they are already present in the indexer with same name..

[sloshburch]

Make sure the SH has no receiving port listening (so it won't start indexing anything from a forwarder). You will need to make sure that the indexes on the SH are forwarded to the indexers as well.

[linu1988]

i have done the steps, the indexes are present in all the servers i.e. search head and indexers. It still stores all the data in search head not using the indexer index. Could you tell if i am missing anything?

[linu1988]

I got your point, will see the results tomorrow after creating the indexes in search head.

[somesoni2]

The index with same name should exist locally where you're scheduling the summary index search (I guess its search head in your case). The data will still be stored in the index inside Indexer, but a local reference is needed at search head.