Enable distributed search via Splunk Web
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Enable distributed search via Splunk Web
Follow these instructions to enable distributed search via Splunk Web. You can also enable distributed search via the CLI or distsearch.conf.
- Click the Admin link in the upper right hand corner:
File:Enabling distributed search via Splunk Web-admin.jpg
- Select the Distributed tab, and click Distributed Search.
To turn on distributed search:
- Set the Distributed Searches to other Splunk servers? radio button to Yes.
- If you want other Splunk instances to automatically find this instance, set the Auto-Discoverable? radio button to Yes.
Note: Discovered servers are not displayed until you commit the change and restart Splunk.
- Add the IP address and port number of any other Splunk instances you want to include in the distributed search cluster. This port number must match the same splunkd port number as in the Admin / Server / Settings on the remote instance. Defaults to 8089.
Note: If you enabled Auto discoverable on other Splunk instances they are displayed in the Discovered Servers column. Each server has an Add button next to it. Click Add to add the servers to cluster.
- Click the Save button to commit the changes.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.