Splunk Search

After adding a new Splunk server in a distributed environment, why does it not show up in results unless I include splunk_server=*?

Path Finder

I recently added a new splunk server in a distributed environment. Now, when I do this search:

index=os earliest="09/01/2015:09:30:00" latest="09/01/2015:09:35:00" | timechart count by splunk_server

the new splunk server does not show up in the results. However, if I do this search,

index=os splunk_server=* earliest="09/01/2015:09:30:00" latest="09/01/2015:09:35:00" | timechart count by splunk_server

then, it shows up.

Can anyone tell me why? I have the search load-balanced so I have about the same number of events going into each indexer.
Thank you in advance.

0 Karma
1 Solution

Esteemed Legend

What is inside distsearch.conf? How did you add the Indexer? Are you using Search Head Pooling?

See this question, too:

http://answers.splunk.com/answers/221468/search-returns-zero-results-searchlog-reports-dist.html

View solution in original post

Esteemed Legend

What is inside distsearch.conf? How did you add the Indexer? Are you using Search Head Pooling?

See this question, too:

http://answers.splunk.com/answers/221468/search-returns-zero-results-searchlog-reports-dist.html

View solution in original post

Path Finder

That was it. I looked at distsearch.conf and saw that all of my indexers except for the new one was in the [distributedSearch:dmc_group_indexer] stanza.

I went into the Distributed Management Console, under Remote instances, edited the Server Role for the new indexer (it was already configured as an indexer), saved it, and then applied the changes and voila, issue resolved. Thanks, woodcock!

To answer your question, in distsearch.conf, I had the stanzas [distributedSearch] which contained all of the indexers and [distributedSearch:dmc_group_indexer] which also contained a list of my indexers except for the recently added one.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!