Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Enable the peer nodes

Before reading this topic, read "Deployment overview".

You ordinarily need to enable multiple peer nodes to deploy a cluster. At a minimum, you must enable at least replication factor number of peers - and potentially more to accommodate horizontal scaling.

Before enabling the set of peers, you must enable and restart the master node, as described in "Enable the master node". When the master starts up for the first time, it will block indexing on the peers until you have enabled and restarted the replication factor number of peers.

Note: The procedure in this topic explains how to use Manager to enable a peer node. You can also enable a peer in two other ways:

Enable the peer

To enable an indexer as a peer node:

1. Click Manager in Splunk Web.

2. In the Distributed Environment group, click Clustering.

3. Select Enable clustering.

4. Select Make this instance a cluster peer.

5. There are a few fields to fill out:

  • What is the location of the cluster master? Enter the IP address or domain name for the master, along with its management port. For example:
  • Secret key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all cluster instances. If the master has a secret key, you must enter it here.
  • Replication port. This is the port on which the peer receives replicated data streamed from the other peers. You can specify any available port for this purpose.

6. Click Save.

7. On the information bar at the top of the page, look for this message: "Splunk must be restarted for changes to take effect. Click here to restart from the Manager." Click the link to go to the Manager page where you can initiate the restart.

8. Repeat this process for all the cluster's peer nodes.

Once you've enabled the replication factor number of peers, the cluster can start indexing and replicating data, as described in "Enable the master node".

View the peer dashboard

After the restart, log back into the peer node and return to the Clustering page in Manager. This time, you see the peer's clustering dashboard. For information on the dashboard, see "View the peer dashboard".

Configure the peers

After enabling the peers, you need to configure them further before you start indexing data. For details, read these topics:

There are also some advanced configuration options available, as described in "Configure the peer nodes".

Enable the master node
Enable the search head

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters