Splunk Search

How to configure Search Head in one of the Index Server

christay
New Member

Hi I have the following setup :

1 x Node Master with 2 x indexer ( Clustering)

How can I configure to designate one of the indexer as my search head server.

Currently the default search head is pointing to my Node Master.

Thanks for the advice.

Tags (1)
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

If you have an index cluster, you don't want to use an indexer was a search head. Indexers in a cluster should only have that one role, and no others.

View solution in original post

0 Karma

christay
New Member

Hi all, thanks for the input. I will relook into my design.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Now this isn't really the best idea and you really should get a stand alone search head ASAP, but if you run searches from the Cluster Master user interface, then the searches will search the data on both indexers...

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you have an index cluster, you don't want to use an indexer was a search head. Indexers in a cluster should only have that one role, and no others.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...