I have 2 servers on which Splunk is installed. I am able to access the Splunk console using splunk2 server.
In the DMC, only splunk2 shows up in the standalone mode with the following server roles:
I cannot access the Splunk console using splunk1 server and I am assuming that is because Splunk web is disabled for this server.
The setup was done earlier and I am now trying to upgrade the instance to the latest version. Before planning the upgrade, I would like to understand what role does splunk1 play in the setup.
Is there a way to find out this information?
Or if you don't care to see all of those fields:
| rest splunkserver=local /services/search/distributed/peers/
|table splunkserver server_roles version
However this query may not list roles for any of:
The only thing missing from splunk2 is indexer. I believe that this search will list your search peers (indexers), I do not have a distributed env to test on, but it is from the DMC App saved searches:
| rest splunk_server=local /services/search/distributed/peers/
Alternatively, just run any search and look at the splunk_server field, which identifies the server where the data lives.