Getting Data In

Searching across clustered and standalone indexers

606866581
Path Finder

Hi,
I've been reading related questions on this topic but I fear they're outdated as of 6.3.

Can I configure a search head to search across, say, 2 clusters and 2 standalone indexers?
I'm struggling to find documentation that confirms or disproves this possibility.

Thank you

EDIT : I should point out that we plan to use the 2 standalone indexers to manage the 2 clusters.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...

Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...

Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch

606866581
Path Finder

I can't believe I missed it, It was right there! Thanks for your time

0 Karma

jmallorquin
Builder

Yes,

Just configure in the search peers in case of cluster one indexer of the cluster (to not duplicate events) and the standalone servers.

Hope i help you

0 Karma

606866581
Path Finder

I'm not sure how that would appear in server.conf. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch doesn't mention how standalone servers are taken into consideration.

0 Karma

jmallorquin
Builder

In the clusters how many servers do you have?

0 Karma

606866581
Path Finder

4, and each cluster will be managed by the 2 standalone indexers. This adds another level of complexity unfortunately

0 Karma

jmallorquin
Builder

And the replication factor?

0 Karma

606866581
Path Finder

2, search factor 2. But would this make a difference?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...