Knowledge Management

Search Head Polling with mounted Bundles

premg
Engager

Hi,

In our platform we are using search head pooling with mounted bundles.
If I have one search head and two indexer(search peers) and i would like to share bundles configuration to one search peer alone.
How can I achieve this?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you only have 1 search head, why are you using pooling? Pooling is for 2 or more search heads.

With that said, Bundles can be configured on a per search-head basis. Meaning, Each indexer has a file which says which search heads send bundles, and which search heads need to use mounted bundles. Each SearchHead is configured to either send bundles, or use mounted bundles. So You can't have one search peer use replicated and one use mounted with a single searchhead.

Make sense? or did I just confuse you?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You don't.

0 Karma

premg
Engager

We have two search heads and two search peers + 1 master.
We have indexer clustering, searchhead pooling and NAS mounted bundles in place.
Everything works fine.

However, for seperate requirement, I have to introduce new indexer with no NAS.
And I have reuse existing search heads.

Now, I want existing searchheads not to share bundle to existing indexers and share bundles to new stand-alone indexer.
How do I achieve that?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If this answers your question, please mark it accepted. Thanks!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It is possible - just not recommended - Especially when you are in a Search Head Pool.

0 Karma

premg
Engager

okies.. With two search heads is it possible to achieve the same.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...