Splunk Search

Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode?

andrearodrigues
Explorer

Hi,

In a distributed mode with 1 search head and 4 indexers, when making a search through the search head, 2 of the for 4 indexers are not showing indexed data except internal logs of other Splunk infrastructure elements. The indexer is reachable, searchable and indexing data of different equipment. Anyone got an idea? (version 6.3.1)

Thanks !

1 Solution

andrearodrigues
Explorer

Thanks for your answer ! Problem solved => multi-sites configuration, need to put site=site0 in server.conf on the search head to perform search accross all sites !

View solution in original post

0 Karma

andrearodrigues
Explorer

Thanks for your answer ! Problem solved => multi-sites configuration, need to put site=site0 in server.conf on the search head to perform search accross all sites !

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

is there a possibility that your search is actually just searching for data that literally resides on only 2/4 indexers? - that is, do you have load balancing set up?

Even if you do have load balancing setup, there is a possibility with certain types of data the your stream will all go to the same indexer if you haven't set forceTimebasedAutoLB=true in outputs.conf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...