Deployment Architecture

Saved searches on multiple indexers

jevenson
Path Finder

We recently moved from one indexer to two indexers in a load balancing configuration. Both indexers are also acting as search heads. If I run a search on indexer A, it is able to pull data from indexer B with no problems.

I copied the savedsearches.conf to both indexers, as well as the dashboard xml file. Right now we can view the saved searches from either indexer, and run those searches. If I add a new search or dashboard on indexer A, how do I get it to show up in the Searches & Reports section on indexer B? For the life of me I can't figure that out, is it possible?

Also, semi-related to this is that all of the alerts that were working on the old indexer are now not working. You can run the search and see that the alerts should be sending an email, but it doesn't do anything. Is there some .conf file I'm missing?

Any ideas?

Tags (1)
1 Solution

Splunker
Communicator

Sounds like you need to configure search-head pooling. Configuration details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling

View solution in original post

Splunker
Communicator

Sounds like you need to configure search-head pooling. Configuration details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling

jevenson
Path Finder

That's exactly what I was looking for. Thanks.
Any idea on why existing alerts are not sending emails? Any new alerts work just fine.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...