How Do I Create a Summary Index in a Search Head Cluster?

[peacher17]

Hi,

Just wondering if there are any best practice guides on how to create a summary index in a Search Head Cluster environment? At the moment we have a local summary index configured on a single search head but are moving to a Search Head Cluster environment. Do we just need to push the summary indexes down to the index layer or is it as easy as creating the summary index as a clustered index and deploying that out in the normal method using the cluster manager?

Thanks

[javiergn]

Hi,

Did you get any answer at all or try this already? I couldn't find anything in the documentation.

AFAIK summary indexes are stored locally within the Search Head, therefore if you move to a SHC environment what's going to happen? will they get replicated?

Thanks,
J

[javiergn]

Ok, I didn't spend enough time going through the documentation:

http://docs.splunk.com/Documentation/Splunk/6.3.1/DistSearch/Forwardsearchheaddata

 By forwarding the results of summary index searches to the indexer level, all search heads have access to them. Otherwise, they're only available to the search head that generates them.

And because summary indexes are created from scheduled jobs, these should get distributed across your Search Heads by the Captain.