Hello,
So, I'm trying to produce the following topology where I have one master/search head and one separate indexer.
I've set up the master and indexer. Data is being forwarded to the indexer and the indexer has it's indexes configured. The master is also configured to send all it's data to the indexer.
The problem now is that I can't access the indexes from the indexer with search except for the internal ones.
Is it possible to search on the other indexes without defining them in the master, or do I also need to recreate them there?
Hi negast,
just a little additional information:
Probably you have to review your distributed search configuration (see at https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/Whatisdistributedsearch ).
Bye.
Giuseppe