We have a single Search Head Node which works over a IndexerCluster.
All Configurations like users, roles, Dashboards etc are present on this Node.
We are now looking to create a Search Head cluster...
...nly one "active"/searchable copy is available at any time.
In a multisite indexercluster, the search affinity allows for replication of the active portion of the searchable data, so that each site c...
...t;- also add the deployer role to the indexcluster master?
2: if no to No.1 do I create 3x new nodes as search heads, then create the search head clusterand a separate deployer node - if so, how...
Hello! We need to implement architecture ES Splunk to 400 GB inclustering (SH, IDX). How we should to count numbers of idx for this capacity? In Splunk docs recommend to use per indexer up to 1...
I am planing a Splunk upgrade, master and search head cluster are on 7.0 but next step is to upgrade multisite Indexercluster, since we are critical on downtime. All Indexers are at same 6.4.*
C...
Hello. Splunk 6.2.1. Built a single-site indexcluster. Two search heads. I can create test indexes across the cluster by editing indexes.conf on the cluster-master, then deploying a config bundle. Works...
Hi All, We have a summary indexing configured on Splunk search head(one of the search head incluster which forwards the data to indexer layer). All the summary indexing jobs will work perfectly f...
Hi!
i have anindexer on server_A and a search head on server_B
there is anindex=test_ind on server_A
i run a search on server_B (search head) to collect some data to test_in to s...
...tried to restrict on one host value...ie. host=hostname. This isn't working either.
I am attempting this on a standalone search head in a distributed environment with anindexercluster. I w...