Is there a way to search for data which has been sent to a specific indexer? I want to make a test (to check our recover scenario):
- stop one indexer (even power off now)
- unmount the SAN LUN whith index data and mount this LUN to another indexer
- start splunk and clean or reindex the index
- see if the data from the "broken" indexer are correctly seen on the test indexer.
Best regards, Bartosz Maruszewski
Do you know is there a way that we can tell a search to only distribute to a specific indexer? - The above solution will indeed show results from only one indexer. But i believe that the search is still distributed to all indexers, but only SHOWS results from the indexer specified.
I am hoping to find a way to limit what indexer(s) the search is initially distributed to.
Can anyone help here???
One more question: What is the value of this field: -the indexer hostname where the data got indexed originally or -the indexer hostname from which the data was sent to the search head for the current search?