Deployment Architecture

Specify which server's _internal index to search

kogane
Path Finder

Is it possible to specify which server's _internal index to search? I have a setup with multiple search head pools, plus a license master with many slaves. My goal is to run a query from any search head, but have it use the _internal index of the license master only.

0 Karma

kristian_kolb
Ultra Champion

If you want to restrict searches to a particular server, you should tell it so;

index=_internal splunk_server=MY_SPLUNK_SERVER | blah blah

If you don't know the name of the server, you could probably find it out through a search like;

index=_internal | dedup splunk_server | table splunk_server

hope this helps,

Kristian

kristian_kolb
Ultra Champion

Well, I guess that you could either

a) define the license master as a search peer for all your search heads, or

b) configure the license master to forward its _internal logs to the indexer(s).

In case b) you'd then be looking at index=_internal host=your_license_master instead of splunk_server

/k

kogane
Path Finder

The license master is only a search head, not an indexer, so it doesn't show up in these results. It's not configured as a search peer, just as part of a search head pool. Perhaps I have to change this, to make what I want to do possible.

0 Karma

MarioM
Motivator

field splunk_server is the one which tell you which splunk instance the data come from

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...