Deployment Architecture

How to setup a search head for 3 indexers

nicolay_koecher
Explorer

Hello,

I´ve 3 indexer running, now I plann to setup one search head to query all 3, how can this be done. 2 Linux Indexer 1 Windows box.

thanks

Tags (1)
0 Karma

srinathd
Contributor

Hi,

In the search head system/local/distsearch file.. you can mention the indexer servers like below

[distributedSearch]
servers = lm-pr-idxr-01:8089,lm-pr-idxr-02:8089,lm-pr-idxr-03:8089,lm-pr-idxr-04:8089,lm-pr-idxr-05:8089,lm-pr-idxr-06:8089,lm-pr-dply-01:8089

Cheers, Srinath

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...