Deployment Architecture

Where should I create Summary Index in a Search Head Cluster?

New Member


I have a query. Where should I create the indexes for summary index data in the Search head clustering architecture? As of now, I have disabled index on the search head cluster members and forwarding the data to the search peers (indexers) by configuring the output.conf. So should I create the index on the search peers (indexers) OR Search head cluster members OR Search head Captain for the summary indexes so that data is available on the search head clustering?

Also, should I install the custom apps on the search peer (indexer) apart from the search head cluster through deployer?


Tags (1)
0 Karma


Hi there,

2 years late but never too late though as I have (had) the same question. There are several solutions but in a cluster context a best practice is to indeed forward summary indexes data to the indexer cluster layer. I invent nothing, I just read it here:

  • By forwarding the results of summary index searches to the indexer level, all search heads have access to them. Otherwise, they're only available to the search head that generates them.

A summary index is a regular index so it can be managed like any other index.


0 Karma


Hello, dhawal_sanghvi

According my experience, you should create summary indexes on both layers on search heads and on indexers.
If you create summary searches only using deployer it is not necessary to have indexes on search heads but in case of creating summary searches using web-interface it is necessary to have summary indexes on search head layer otherwise splunk can not find summary index to write summary data and will not allow save the search.

To manage indexers(search peers) you should use Cluster Master use Deployer only for Search Head management.
You can copy stanzas with your summary indexes from indexes.conf of search head layer (usually they are on deployer) and create custom app with these stanzas( or extend existing) on Cluster Master. So it is not necessary to do something special on Captain.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...