- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Searching across clustered and standalone inde...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I've been reading related questions on this topic but I fear they're outdated as of 6.3.
Can I configure a search head to search across, say, 2 clusters and 2 standalone indexers?
I'm struggling to find documentation that confirms or disproves this possibility.
Thank you
EDIT : I should point out that we plan to use the 2 standalone indexers to manage the 2 clusters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...
Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...
Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can't believe I missed it, It was right there! Thanks for your time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes,
Just configure in the search peers in case of cluster one indexer of the cluster (to not duplicate events) and the standalone servers.
Hope i help you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm not sure how that would appear in server.conf. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch doesn't mention how standalone servers are taken into consideration.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the clusters how many servers do you have?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
4, and each cluster will be managed by the 2 standalone indexers. This adds another level of complexity unfortunately
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And the replication factor?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2, search factor 2. But would this make a difference?
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
