Splunk Search

Where is Splunk creating my summary index?


I have a customer who is scheduling a search that uses db query. He then wants to send the output of that search to a summary index. Since db connect runs from the search-head, will the summary index get created on the search-head? I'm trying to make all indexers are created on the indexers. (We are running Splunk 6.1.1)

0 Karma

Splunk Employee
Splunk Employee

If your search head is setup as a forwarder, the summary index will be populated on the indexers. It sounds like this is what you want. That configuration (Forwarding Search Head data to Indexers) is considered a best practice. Additional information on why (& how to set that up) may be found here: http://docs.splunk.com/Documentation/Splunk/6.2.4/DistSearch/Forwardsearchheaddata.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!