Deployment Architecture

How do you make sure that a specific index of the indexers can be searched from the search head?

superhm
Explorer

Hello.

In the distributed search function, I want to make sure that specific index of the indexers can be searched from the search head.

How can I do this?

ex)
- Search Head
- Indexer-1 : All indexes
- Indexer-2 : _audit (Just one index)

Thank you.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

As far as I know you can't achieve this. When you create role on search head and assign specific indexes access & when you run search on search head in distributed environment, the search distribute to all the indexers so you can't restrict to only search _audit index from indexer2 and all indexes from indexer1.

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

As far as I know you can't achieve this. When you create role on search head and assign specific indexes access & when you run search on search head in distributed environment, the search distribute to all the indexers so you can't restrict to only search _audit index from indexer2 and all indexes from indexer1.

0 Karma

superhm
Explorer

Thank you for your advice...

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...