Splunk Enterprise

Problem with Indexer and Search Head on one server?

splunk_enjoyer
Explorer

Hello Splunk lovers! 
I have problem on Splunk Cluster.
I had 3 SH and 3 Indexers.

On indexer-1 installed deployer, indexer managament and cluster master.

On cluster master i see indexer-1 search head and indexer too. B
but its should not be search head, should be indexer only
So, wtf and how can i set him only indexer?
thanks you for help! 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Cluster Manager (CM) must not be a member of the cluster - it must be a separate instance.

Similarly, the deployer should be a separate instance.  However, on a small environment such as this, the CM and deployer can be on the same instance.

Make sure each indexer is correctly added to the cluster.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Addclusterpeer

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The Cluster Manager (CM) must not be a member of the cluster - it must be a separate instance.

Similarly, the deployer should be a separate instance.  However, on a small environment such as this, the CM and deployer can be on the same instance.

Make sure each indexer is correctly added to the cluster.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Addclusterpeer

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...