Knowledge Management

summary index on search head not showing all the indexers in splunk_server field

vadud3
Path Finder

When I search for index=summary in search head, the result
only shows one of the server in splunk_server field. But I have 3 indexers.
Shouldn't I see all the indxers name in the splunk_server field?

Tags (2)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

Hey vadud3,

The summary index is actually an index stored on the search head, and as such is going to show the search head as the indexer responsible for the answer. You would need to have a field in your summary data which shows the original indexer. If you have 3 indexers, you may also want to think about forwarding all of your indexes off of the search head, such that no indexing is done on the search head, thus taking advantage of your distributed setup.

HTH

Dave

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Is the indexer showing up in the results the search head or one of the indexers? You may want to look into using the metadata search command to dig into what data is on what search head:
http://docs.splunk.com/Documentation/Splunk/latest/searchreference/metadata

Dave

0 Karma

vadud3
Path Finder

That is how I have it setup. But I am wandering why one of the indexer shows up in splunk_server list ?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...