Is there a way to separate indexer and search head apart?

[muradgh]

Hi Splunkers

I currently have one Splunk machine that has two rules at once (a search head and an indexer) and I want to separate each rule from another with its own separate machine.

Is there a way to do such action? if so, what are the steps to do so?

Thanks.

[gcusello · Accepted solution]

Hi @muradgh,

you have to:

• install a new server with the correct hardware reference,
• install Splunk on it,
• configurate it to work with a Forwarder license,
• forward all logs to the other server,
• configure it as Searche Haed that uses the other server
• use it for the searches.

for more information you can see at https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Whatisdistributedsearch

Ciao.

Giuseppe

[muradgh]

Thank you @gcusello ^^

[gcusello]

Hi @muradgh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉