Splunk Enterprise

Splunk Upgrade Requirement Clarification

R15
Path Finder

Hi, 

We're preparing to upgrade SE from 8 to 9 and have a question about this requirement:

For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: 

  • ...
  • ...
  • They do not run their own saved searches

If our indexers are also search heads, would that violate this?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

What you describe sounds like a non-standard installation.  If the indexers are replicating buckets to each other then that would be an indexer cluster, which should not also be operating as search heads.  With an indexer cluster, the search heads should be separate instances.

To answer your question, yes, I believe all of your saved searches present on the indexers would violate the condition.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Indexers should not also be search heads, unless you have a collection of standalone Splunk instances (which would be uncommon).

A standalone instance is not a distributed deployment so the listed conditions do not apply.

In a distributed deployment, search head and indexer instances are on separate machines and the SHs send search requests to the indexers for fulfillment.  If this is the case at your company and you also have the indexers acting as search heads then you must make sure the indexers do not have their own saved searches.

---
If this reply helps you, Karma would be appreciated.

R15
Path Finder

@richgalloway 
I'm new here and still trying to wrap my around this as I prepare to help upgrade and then later expand our setup. It's a very small deployment (for now), 2 indexers which are also search heads with replication between indexers. Would this mean ALL of our saved searches violate the above?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you describe sounds like a non-standard installation.  If the indexers are replicating buckets to each other then that would be an indexer cluster, which should not also be operating as search heads.  With an indexer cluster, the search heads should be separate instances.

To answer your question, yes, I believe all of your saved searches present on the indexers would violate the condition.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...