1. Search Head: splunk-sh
2. My search peers: splunk-idx1 and splunk-idx2
3. My forwarders: splunk-fw1 and splunk-fw2
My Data Flow:
splunk-fw1 -> sends data -> splunk-idx1 into index mail
splunk-fw2 -> sends data -> splunk-idx2 into index mess
IMP NOTE: index mail only exists on splunk-idx1 and index mess only exists on splunk-idx2
My Search on the search head:
When I run the above search I am expecting the search head to send the search to both the search peers, splunk-idx1 and splunk-idx2 but I find that Splunk, quiet intelligently, only sends the search to the search peer that has the index mess and does not send it to the other search peer.
Is this by design ?
Another question. Is it a valid architecture to not have the same indexes on all the search peers because I just want a single querying interface(search head) but at the same time I want to spread the data onto multiple indexers.