Deployment Architecture

How do you make sure that a specific index of the indexers can be searched from the search head?

superhm
Explorer

Hello.

In the distributed search function, I want to make sure that specific index of the indexers can be searched from the search head.

How can I do this?

ex)
- Search Head
- Indexer-1 : All indexes
- Indexer-2 : _audit (Just one index)

Thank you.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

As far as I know you can't achieve this. When you create role on search head and assign specific indexes access & when you run search on search head in distributed environment, the search distribute to all the indexers so you can't restrict to only search _audit index from indexer2 and all indexes from indexer1.

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

As far as I know you can't achieve this. When you create role on search head and assign specific indexes access & when you run search on search head in distributed environment, the search distribute to all the indexers so you can't restrict to only search _audit index from indexer2 and all indexes from indexer1.

0 Karma

superhm
Explorer

Thank you for your advice...

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...