I have 2 Splunk Test Servers. I had one as an indexer and one as the search Head. But, we are needing to restore a single index=restoredb from our production instance to this test env. We have 2 indexers in our Production servers, so I have made both Test Servers indexers with one of those 2 being a search head still. I'm a little confused how to setup distributed searching? When I try and add the search head/indexer it says 'Duplicate Servername'. I'm not sure if this means that the search will automatically look on the search head and then the other indexer?
Our Production Indexers are not clustered. So the data from both needs to be restored to different place to look at all the data.
... View more