Security

knowledge bundle without a shared storage?

MarMoh
Path Finder

Hi,

I have one search head and one indexer. How can I use the Knowledge bundle without using a shared storage?

Thanks,
Maryam

0 Karma
1 Solution

Ayn
Legend

If I don't misunderstand you somehow what you're asking for is really the normal way to setup distributed search. Configure the indexer as a search peer to the search head, and the search head will automatically send the knowledge bundles the indexer needs when issuing searches. http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch

View solution in original post

0 Karma

Ayn
Legend

If I don't misunderstand you somehow what you're asking for is really the normal way to setup distributed search. Configure the indexer as a search peer to the search head, and the search head will automatically send the knowledge bundles the indexer needs when issuing searches. http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch

View solution in original post

0 Karma

rgcurry
Contributor

I am curious as to what has you thinking you need/want to do this? This is designed mostly for multiple indexers. True it is a performance consideration but with your configuration I don't know that it will gain you much improvments.

0 Karma

rgcurry
Contributor

As Ayn said above, the Knowledge Bundle is a part of normal processing. It seems to me that you are considering Search Head pooling where the information the Search Heads send to the Indexers is made static and stored on a shared file system to which all Search Heads and Indexers can access and updated when there are changes made to these configs. More info at http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Configuresearchheadpooling. Know that there is a performance hit with this option; your milage may vary.

0 Karma

MarMoh
Path Finder

Well, Just doing it for the future scalability purposes.So for one search head and one indexer I do not need to use the bundle?
another question is in future if I add more indexers how much work it would be to configure the Knowledge Bundle?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!