Hi,
I've been reading related questions on this topic but I fear they're outdated as of 6.3.
Can I configure a search head to search across, say, 2 clusters and 2 standalone indexers?
I'm struggling to find documentation that confirms or disproves this possibility.
Thank you
EDIT : I should point out that we plan to use the 2 standalone indexers to manage the 2 clusters.
The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...
Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch
The searching across multiple indexer clusters is configured by method described here
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch#By_editing_s...
Below link should give you how to then add the non-clustered/standalone Indexers.
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureclusteredandnonclusteredsearch
I can't believe I missed it, It was right there! Thanks for your time
Yes,
Just configure in the search peers in case of cluster one indexer of the cluster (to not duplicate events) and the standalone servers.
Hope i help you
I'm not sure how that would appear in server.conf. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch doesn't mention how standalone servers are taken into consideration.
In the clusters how many servers do you have?
4, and each cluster will be managed by the 2 standalone indexers. This adds another level of complexity unfortunately
And the replication factor?
2, search factor 2. But would this make a difference?