Security

knowledge bundle without a shared storage?

MarMoh
Path Finder

Hi,

I have one search head and one indexer. How can I use the Knowledge bundle without using a shared storage?

Thanks,
Maryam

0 Karma
1 Solution

Ayn
Legend

If I don't misunderstand you somehow what you're asking for is really the normal way to setup distributed search. Configure the indexer as a search peer to the search head, and the search head will automatically send the knowledge bundles the indexer needs when issuing searches. http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch

View solution in original post

0 Karma

Ayn
Legend

If I don't misunderstand you somehow what you're asking for is really the normal way to setup distributed search. Configure the indexer as a search peer to the search head, and the search head will automatically send the knowledge bundles the indexer needs when issuing searches. http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch

0 Karma

rgcurry
Contributor

I am curious as to what has you thinking you need/want to do this? This is designed mostly for multiple indexers. True it is a performance consideration but with your configuration I don't know that it will gain you much improvments.

0 Karma

rgcurry
Contributor

As Ayn said above, the Knowledge Bundle is a part of normal processing. It seems to me that you are considering Search Head pooling where the information the Search Heads send to the Indexers is made static and stored on a shared file system to which all Search Heads and Indexers can access and updated when there are changes made to these configs. More info at http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Configuresearchheadpooling. Know that there is a performance hit with this option; your milage may vary.

0 Karma

MarMoh
Path Finder

Well, Just doing it for the future scalability purposes.So for one search head and one indexer I do not need to use the bundle?
another question is in future if I add more indexers how much work it would be to configure the Knowledge Bundle?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...