Getting Data In

Why am I unable to create a connection between any of my instances trying to set up a distributed search environment?

qazwsxedc994
Explorer

I am trying to create a splunk environment with an Indexer, Search Head, Forwarder and a Deployment Server, however, I can't get any connectivity between any of my instances. In terms of configuration I have Splunk properly installed on all my instances along with:

Indexer: enable listen 9997 -auth admin:changeme

search head:
outputs.conf
[indexAndForward]
index = false

[tcpout]
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:my_search_peers]
server= INDEXER_IP:9997
autoLB = true

add search-server -host INDEXER_IP:8089
restart
splunk edit licenser-localslave -master_uri 'https://search_head_ip:8089'

Forwarder
splunk add forward-server INDEXER_IP:9997

Deployer
{SPLUNK_FWD_HOME}/etc/apps/deployclient/local/deploymentclient.conf
[deployment-client]
[target-broker:deploymentServer]
targetUri = <DEPLOY_IP>

Have I missed anything here or have I done something wrong?

Cheers for any help!

0 Karma
1 Solution

qazwsxedc994
Explorer

I fixed my own problem. I forgot to enable distributed search on the indexer.

./splunk enable dist-search -auth admin:changeme

View solution in original post

qazwsxedc994
Explorer

I fixed my own problem. I forgot to enable distributed search on the indexer.

./splunk enable dist-search -auth admin:changeme
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...