We have a single Search Head Node which works over a IndexerCluster.
All Configurations like users, roles, Dashboards etc are present on this Node.
We are now looking to create a Search Head cluster...
...nly one "active"/searchable copy is available at any time.
In a multisite indexercluster, the search affinity allows for replication of the active portion of the searchable data, so that each site c...
Hi All, We have a summary indexing configured on Splunk search head(one of the search head incluster which forwards the data to indexer layer). All the summary indexing jobs will work perfectly f...
...nvironment, I have anindexercluster of 3 indexers, two independent search heads, and one Universal forwarder.
My question is where the BRO IDS app goes and how it works?
What I have done is - I have in...
...or dev purposes and I created my props/transforms for this log file and got it working just fine. However, when I deploy it across my clusterand attempt to index these files in production, I am not g...
Hello.
I'm running on RHEL 7 with 6.6.3 and anIndexercluster (3 peers), and have 2 Search Heads not in a SHC but connected induvidually to the indexcluster.
I try to use KV store with a c...
...ave to install shuttl, both search head and indexers?
Secondly, I'm unclear about how setting up shuttl configuration files (archiver.xml/splunk.xml/server.xml) to identify the cluster.
T...
...t;- also add the deployer role to the indexcluster master?
2: if no to No.1 do I create 3x new nodes as search heads, then create the search head clusterand a separate deployer node - if so, how...
I am planing a Splunk upgrade, master and search head cluster are on 7.0 but next step is to upgrade multisite Indexercluster, since we are critical on downtime. All Indexers are at same 6.4.*
C...
Hi!
i have anindexer on server_A and a search head on server_B
there is anindex=test_ind on server_A
i run a search on server_B (search head) to collect some data to test_in to s...