Deployment Architecture

Problem accessing the indexes from the indexer with one master and one search head

negast
New Member

Hello,

So, I'm trying to produce the following topology where I have one master/search head and one separate indexer.
I've set up the master and indexer. Data is being forwarded to the indexer and the indexer has it's indexes configured. The master is also configured to send all it's data to the indexer.

The problem now is that I can't access the indexes from the indexer with search except for the internal ones.
Is it possible to search on the other indexes without defining them in the master, or do I also need to recreate them there?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi negast,
just a little additional information:

  • when you say "master" are you speaking about "Master License"?
  • had you configured in your Search Head the distributed Search and your indexer as Search Peer?
  • can you see Indexer's not internal logs from Indexer?

Probably you have to review your distributed search configuration (see at https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/Whatisdistributedsearch ).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...