Join the Conversation
- Find Answers
- :
- Premium Solutions
- :
- Splunk ITSI
- :
- ITSI installation
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a Search Head called JOHN
- it has several search peers connected to it in distributed environment , it has around 100 Search Peers
-so EMMA search peer 1 and EMMA search peer 2 are both connected to JOHN along with another Search Peers
So now i am trying to install ITSI app in SH -JOHN
- but the indexes that r created by ITSI APP itsi_summary,
anomaly_detection etc., - shd be only written into EMMA SEARCH PEERS 1 and 2 but not in all search peers connected to JOHN.
So by placing SA-IndexCreation in only Emma indexer 1 and indexer 2 can we achieve dis ??
IS that possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @ramarcsight
Assuming your Indexers are clustered:
Given that data will be replicated on Index Clustering, try this link below to disable replication to specific peers (your EMMA search peer 1 and EMMA search peer 2).
https://answers.splunk.com/answers/376042/is-it-possible-to-disable-replication-to-specific.html
Assuming your Indexers are non-clustered:
Try to forward your data on the EMMA Indexer 1 and EMMA Indexer 2 only.
Check this link below:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_data_by_target_i...
Related questions on this case:
https://answers.splunk.com/answers/55131/specific-index-forwarding-to-external-index-tier.html
https://answers.splunk.com/answers/124648/how-to-send-only-certain-indexes-from-a-search-head-to-the...
Hope it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @ramarcsight
Assuming your Indexers are clustered:
Given that data will be replicated on Index Clustering, try this link below to disable replication to specific peers (your EMMA search peer 1 and EMMA search peer 2).
https://answers.splunk.com/answers/376042/is-it-possible-to-disable-replication-to-specific.html
Assuming your Indexers are non-clustered:
Try to forward your data on the EMMA Indexer 1 and EMMA Indexer 2 only.
Check this link below:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_data_by_target_i...
Related questions on this case:
https://answers.splunk.com/answers/55131/specific-index-forwarding-to-external-index-tier.html
https://answers.splunk.com/answers/124648/how-to-send-only-certain-indexes-from-a-search-head-to-the...
Hope it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Hi
The thing is EMMA1 and EMMA2 has thier own Cluster master ,so how to create SA-IndexCreation Indexes in only Emma1 and Emma2??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Indexer clustered?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...
July Community Events: Master ITSI 5.0 & Automate Splunk
New Release of Federated Search: Bringing Splunk Analytics to More of Your Data
