Deployment Architecture

Several search heads and several indexers WITHOUT replication is possible?

highsplunker
Contributor

Hey guys,
Several search heads and several indexers WITHOUT replication is possible?

I have several search heads "watching to" one indexer.
I would like to place an indexer in another Data Center: with NO replication functionality, but with possibility to search thru both indexers. Is it possible?

Search heads: v 6.5.2, v 7.2.3
Indexer: v 6.5.2

Labels (3)
1 Solution

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Hey @highsplunker, I see you like working with the community to solve splunk problems for FREE!

Can you please show the community some love in return by accepting an answer OR perhaps commenting further with why an answer proposed did not work for you?

This will help everyone understand that you respect their time and that it's in general FUN & REWARDING to interact with you.

We like watching everyone grow! However, when we don't know if we've helped it reduces our overall effectiveness as a FREE community support channel.

Cheers and thanks in advance for taking the short amount of time to accept answers that help!!!

0 Karma

highsplunker
Contributor

hi @jkat54 ,
you're probably right, my bad,
i will check my tickets once again!

cheers

rashid

jkat54
SplunkTrust
SplunkTrust

Hope you didn't get 30 emails as I updated my comment 😉 thanks mate!

0 Karma

waechtler_amaso
Explorer

Yes, a searchhead can search through more than one indexer

On each searchhead, go to Settings » Distributed search to enable this feature and add the new search peer
You will need admin credentials for the new indexer to be added

You may run into problems when splunk versions are different on indexer and searchhead (searchhaed could use features not present in old indexer)

highsplunker
Contributor

hi @waechtler_amasol !
thanks!
worked OK!

sorry for the delay! 🙂

best regards,
rashid

gcusello
SplunkTrust
SplunkTrust

Hi @highsplunker,
Yes, you can configure one (or more) Search Head to see more Indexers configuring them in [Settings -- Distributed Search -- Search Peers].
In this way you can search on all the configured Indexers.
Only one attention, try to align Splunk versions: there shouldn't be problems, but it isn't a best practice and 6.5.2 is very old!

Ciao.
Giuseppe

highsplunker
Contributor

hi @gcusello !
thanks a lot! you're right!
(sorry for the delay!)

best wishes,
rashid

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...