The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: crash | Next Topic: forwarding/receiving and 4.x
Posts 1–3 of 3
Despite having hundreds of pages of manuals and endless forums entries in front of me, I'm unable to find the answer to what I think should be a simple question.
I have a search server (ServerA) and a index server (serverB).
Where in the configuration/setup do I tell ServerA to search against the indexes on ServerB?
This is correct, but not necessarily easiest: http://www.splunk.com/base/Documentation/latest/Admin/Configuredistributedsearch
This is easiest:
Server A: Login -> Manager -> Distributed Search -> Search Peers -> Add New
Enter server B host and splunkd port (default 8089), any Server B admin account name (admin), Server B admin account password twice (changeme) (id/pass are only used right now for one-time setup, not saved).