Deployment Architecture

Problem accessing the indexes from the indexer with one master and one search head

negast
New Member

Hello,

So, I'm trying to produce the following topology where I have one master/search head and one separate indexer.
I've set up the master and indexer. Data is being forwarded to the indexer and the indexer has it's indexes configured. The master is also configured to send all it's data to the indexer.

The problem now is that I can't access the indexes from the indexer with search except for the internal ones.
Is it possible to search on the other indexes without defining them in the master, or do I also need to recreate them there?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi negast,
just a little additional information:

  • when you say "master" are you speaking about "Master License"?
  • had you configured in your Search Head the distributed Search and your indexer as Search Peer?
  • can you see Indexer's not internal logs from Indexer?

Probably you have to review your distributed search configuration (see at https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/Whatisdistributedsearch ).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...