Getting Data In

Why am I unable to create a connection between any of my instances trying to set up a distributed search environment?

qazwsxedc994
Explorer

I am trying to create a splunk environment with an Indexer, Search Head, Forwarder and a Deployment Server, however, I can't get any connectivity between any of my instances. In terms of configuration I have Splunk properly installed on all my instances along with:

Indexer: enable listen 9997 -auth admin:changeme

search head:
outputs.conf
[indexAndForward]
index = false

[tcpout]
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:my_search_peers]
server= INDEXER_IP:9997
autoLB = true

add search-server -host INDEXER_IP:8089
restart
splunk edit licenser-localslave -master_uri 'https://search_head_ip:8089'

Forwarder
splunk add forward-server INDEXER_IP:9997

Deployer
{SPLUNK_FWD_HOME}/etc/apps/deployclient/local/deploymentclient.conf
[deployment-client]
[target-broker:deploymentServer]
targetUri = <DEPLOY_IP>

Have I missed anything here or have I done something wrong?

Cheers for any help!

0 Karma
1 Solution

qazwsxedc994
Explorer

I fixed my own problem. I forgot to enable distributed search on the indexer.

./splunk enable dist-search -auth admin:changeme

View solution in original post

qazwsxedc994
Explorer

I fixed my own problem. I forgot to enable distributed search on the indexer.

./splunk enable dist-search -auth admin:changeme
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...