Deployment Architecture

Where should I create Summary Index in a Search Head Cluster?

dhawal_sanghvi
New Member

Hello,

I have a query. Where should I create the indexes for summary index data in the Search head clustering architecture? As of now, I have disabled index on the search head cluster members and forwarding the data to the search peers (indexers) by configuring the output.conf. So should I create the index on the search peers (indexers) OR Search head cluster members OR Search head Captain for the summary indexes so that data is available on the search head clustering?

Also, should I install the custom apps on the search peer (indexer) apart from the search head cluster through deployer?

Thanks,
Dhawal

Tags (1)
0 Karma

fabricebourel
Explorer

Hi there,

2 years late but never too late though as I have (had) the same question. There are several solutions but in a cluster context a best practice is to indeed forward summary indexes data to the indexer cluster layer. I invent nothing, I just read it here: https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Forwardsearchheaddata

  • By forwarding the results of summary index searches to the indexer level, all search heads have access to them. Otherwise, they're only available to the search head that generates them.

A summary index is a regular index so it can be managed like any other index.

Cheers.

0 Karma

andrey2007
Contributor

Hello, dhawal_sanghvi

According my experience, you should create summary indexes on both layers on search heads and on indexers.
If you create summary searches only using deployer it is not necessary to have indexes on search heads but in case of creating summary searches using web-interface it is necessary to have summary indexes on search head layer otherwise splunk can not find summary index to write summary data and will not allow save the search.

To manage indexers(search peers) you should use Cluster Master use Deployer only for Search Head management.
You can copy stanzas with your summary indexes from indexes.conf of search head layer (usually they are on deployer) and create custom app with these stanzas( or extend existing) on Cluster Master. So it is not necessary to do something special on Captain.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...