Getting Data In

What happens when distributed search is enabled and one of the indexers goes down?

Explorer

Hello,

I've read Splunk documentation on that matter but I'm not able to find my answer. Does anyone know how Splunk behaves when distributed search is enabled and one of the index becomes offline ?

Does it let you search the other indexes (even though results won't be complete) ? Or do you get a big warning and can't do anything else until that Indexer is back online ?

Thanks,

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi gnoellbn,

you are still able to search, but you will get an info that the search result will not be complete because of one or more searches peers being down or unreachable.

hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi gnoellbn,

you are still able to search, but you will get an info that the search result will not be complete because of one or more searches peers being down or unreachable.

hope this helps ...

cheers, MuS

View solution in original post

Explorer

Excalty what I was lloking for 😉
Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!