Splunk Enterprise

Do i create indexs on Search head or on each indexer on non cluster envioment



We have a indexer{2 indexers] in our environment, 2 fowarder and 1 search heads. If we create indexes on a search head using GUI will the configuration for these be reflected in indexers?

Please advice detailed steps to create indexs in a simple splunk envioment with 1 Search head ,2 Fowarders and 2 Indexers .


Tags (1)
0 Karma

Path Finder


Create indexes in each indexer at /etc/apps folder.

From search head go to settings - search peers--> add indexers with management port.

Forward data from forwarders to indexers directly.

Logs will be searchable from search head. No need to create index in search head. Just add indexers in search peers of search head as explained above.



There is no difference in the splunk software for search head and index. Its the configuration what it make the difference and assign the roles.

Indexes created on search head do not transfer to indexers automatically. You need to create index on the indexers manually or use a deployment server to push the indexes.conf automatically.

Since its a distributed architecture, you could decide which data goes to which indexer and index and based on that you can create index on specific indexers using Splunk Web or cli or using indexes.conf

Here is a detailed documentation about creating index in distributed environment.


Also its recommended to send search head data also to indexers . Detailed steps are available in

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...