Splunk 9.x Enterprise Certified Admin Guide by Srikanth Yarlagadda

Author:Srikanth Yarlagadda
Language: eng
Format: epub
Publisher: Packt
Published: 2023-01-15T00:00:00+00:00

Configuring distributed search

The distributed search feature requires configuration to establish connectivity from the search head to indexers or search peers. From a standalone search head and indexer architecture to a large-scale multisite clustering setup, all implementations make use of the distributed search feature. Refer to the deployment type in Figure 7.2, which has three search heads in a cluster, enabling distributed search to interact with three independent indexers. Indexers receive data from various sources, such as universal forwarders, syslog inputs, and technology add-ons for indexing. Here are a few essential points to understand about distributed search:

Search heads are preconfigured to send queries to search peers upon user request.

Search heads consolidate the results received from peers that participate in the search.

Search heads present the results to the user.

A continuous background process called knowledge bundle replication runs (you’ll learn about this later in this chapter) on the search head captain, which keeps sharing the information with search peers. In a non-cluster search head environment, a standalone search head shares the bundle with all the search peers it is connected to.

Splunk recommends dedicating a separate Splunk Enterprise instance to each role, such as a deployment server for forwarder management, a search head deployer for the search head cluster, a license manager for licensing, and a monitoring console for overall deployment monitoring. However, in underutilized deployments, management components can be colocated according to the matrix provided at https://tinyurl.com/26f9n5zf.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.