Splunk Enterprise

Do i create indexs on Search head or on each indexer on non cluster envioment



We have a indexer{2 indexers] in our environment, 2 fowarder and 1 search heads. If we create indexes on a search head using GUI will the configuration for these be reflected in indexers?

Please advice detailed steps to create indexs in a simple splunk envioment with 1 Search head ,2 Fowarders and 2 Indexers .


Tags (1)
0 Karma

Path Finder


Create indexes in each indexer at /etc/apps folder.

From search head go to settings - search peers--> add indexers with management port.

Forward data from forwarders to indexers directly.

Logs will be searchable from search head. No need to create index in search head. Just add indexers in search peers of search head as explained above.



There is no difference in the splunk software for search head and index. Its the configuration what it make the difference and assign the roles.

Indexes created on search head do not transfer to indexers automatically. You need to create index on the indexers manually or use a deployment server to push the indexes.conf automatically.

Since its a distributed architecture, you could decide which data goes to which indexer and index and based on that you can create index on specific indexers using Splunk Web or cli or using indexes.conf

Here is a detailed documentation about creating index in distributed environment.


Also its recommended to send search head data also to indexers . Detailed steps are available in

What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...