Splunk Search

Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode?

andrearodrigues
Explorer

Hi,

In a distributed mode with 1 search head and 4 indexers, when making a search through the search head, 2 of the for 4 indexers are not showing indexed data except internal logs of other Splunk infrastructure elements. The indexer is reachable, searchable and indexing data of different equipment. Anyone got an idea? (version 6.3.1)

Thanks !

1 Solution

andrearodrigues
Explorer

Thanks for your answer ! Problem solved => multi-sites configuration, need to put site=site0 in server.conf on the search head to perform search accross all sites !

View solution in original post

0 Karma

andrearodrigues
Explorer

Thanks for your answer ! Problem solved => multi-sites configuration, need to put site=site0 in server.conf on the search head to perform search accross all sites !

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

is there a possibility that your search is actually just searching for data that literally resides on only 2/4 indexers? - that is, do you have load balancing set up?

Even if you do have load balancing setup, there is a possibility with certain types of data the your stream will all go to the same indexer if you haven't set forceTimebasedAutoLB=true in outputs.conf

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...