When I search for index=summary
in search head, the result
only shows one of the server in splunk_server
field. But I have 3 indexers.
Shouldn't I see all the indxers name in the splunk_server
field?
Hey vadud3,
The summary index is actually an index stored on the search head, and as such is going to show the search head as the indexer responsible for the answer. You would need to have a field in your summary data which shows the original indexer. If you have 3 indexers, you may also want to think about forwarding all of your indexes off of the search head, such that no indexing is done on the search head, thus taking advantage of your distributed setup.
HTH
Dave
Is the indexer showing up in the results the search head or one of the indexers? You may want to look into using the metadata search command to dig into what data is on what search head:
http://docs.splunk.com/Documentation/Splunk/latest/searchreference/metadata
Dave
That is how I have it setup. But I am wandering why one of the indexer shows up in splunk_server list ?