Deployment Architecture

Problem accessing the indexes from the indexer with one master and one search head

negast
New Member

Hello,

So, I'm trying to produce the following topology where I have one master/search head and one separate indexer.
I've set up the master and indexer. Data is being forwarded to the indexer and the indexer has it's indexes configured. The master is also configured to send all it's data to the indexer.

The problem now is that I can't access the indexes from the indexer with search except for the internal ones.
Is it possible to search on the other indexes without defining them in the master, or do I also need to recreate them there?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi negast,
just a little additional information:

  • when you say "master" are you speaking about "Master License"?
  • had you configured in your Search Head the distributed Search and your indexer as Search Peer?
  • can you see Indexer's not internal logs from Indexer?

Probably you have to review your distributed search configuration (see at https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/Whatisdistributedsearch ).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...