Summary Question

[daniel333]

So if I add a single search head and add my existing indexers/search peers to it. BUT DO NOT set data forwardering on it. Any summary searches I create will store the results LOCALLY on my search head, correct? Or will the summary just fail?

background: I have a PILE of what I call "disposable" indexers. If they die I don't care. Recently management has asked that we start to summarize and store some stats .. basically for ever. I don't want that data on the disposable indexers. it would not be a big deal to create a Virtual machine 250gigs of space for the summary and summarize the data there.

[woodcock · Accepted solution]

By default, even with Indexers defined as search peers, any Summary Index defined will be created and exist on the Search Head where it was defined. You have to do much extra work to move it.

[jkat54]

This should work if you use the collect command along with its spool=true option. The spool option writes a file locally I believe and then the search head will ingest but not forward as per your configuration.