Splunk Enterprise

Splunk Upgrade Requirement Clarification

R15
Path Finder

Hi, 

We're preparing to upgrade SE from 8 to 9 and have a question about this requirement:

For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: 

  • ...
  • ...
  • They do not run their own saved searches

If our indexers are also search heads, would that violate this?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

What you describe sounds like a non-standard installation.  If the indexers are replicating buckets to each other then that would be an indexer cluster, which should not also be operating as search heads.  With an indexer cluster, the search heads should be separate instances.

To answer your question, yes, I believe all of your saved searches present on the indexers would violate the condition.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Indexers should not also be search heads, unless you have a collection of standalone Splunk instances (which would be uncommon).

A standalone instance is not a distributed deployment so the listed conditions do not apply.

In a distributed deployment, search head and indexer instances are on separate machines and the SHs send search requests to the indexers for fulfillment.  If this is the case at your company and you also have the indexers acting as search heads then you must make sure the indexers do not have their own saved searches.

---
If this reply helps you, Karma would be appreciated.

R15
Path Finder

@richgalloway 
I'm new here and still trying to wrap my around this as I prepare to help upgrade and then later expand our setup. It's a very small deployment (for now), 2 indexers which are also search heads with replication between indexers. Would this mean ALL of our saved searches violate the above?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you describe sounds like a non-standard installation.  If the indexers are replicating buckets to each other then that would be an indexer cluster, which should not also be operating as search heads.  With an indexer cluster, the search heads should be separate instances.

To answer your question, yes, I believe all of your saved searches present on the indexers would violate the condition.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...