Managing Indexers and Clusters of Indexers

Enable the peer nodes

Before reading this topic, read "Deployment overview".

You ordinarily need to enable multiple peer nodes to deploy a cluster. At a minimum, you must enable at least replication factor number of peers - and potentially more to accommodate horizontal scaling.

Before enabling the set of peers, you must enable and restart the master node, as described in "Enable the master node". When the master starts up for the first time, it will block indexing on the peers until you have enabled and restarted the replication factor number of peers.

Note: The procedure in this topic explains how to use Splunk Web to enable a peer node. You can also enable a peer in two other ways:

• Directly edit the peer's server.conf file. See "Configure the cluster with server.conf" for details.
• Use the CLI edit cluster-config command. See "Configure the cluster with the CLI" for details.

Enable the peer

To enable an indexer as a peer node:

1. Click Settings in the upper right corner of Splunk Web.

2. In the Distributed environment group, click Clustering.

3. Select Enable clustering.

4. Select Peer node and click Next.

5. There are a few fields to fill out:

• Master IP address or Hostname. Enter the master's IP address or hostname. For example: https://10.152.31.202.
• Master port. Enter the master's management port. For example: 8089.
• Peer replication port. This is the port on which the peer receives replicated data streamed from the other peers. You can specify any available, unused port for this purpose. This port must be different from the management port and receiving port.
• Security key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all cluster instances. If the master has a security key, you must enter it here.

6. Click Enable peer node.

7. The message appears, "You must restart Splunk for the peer node to become active." Click Go to Server Controls to go to the Settings page where you can initiate the restart.

8. Repeat this process for all the cluster's peer nodes.

Once you've enabled the replication factor number of peers, the cluster can start indexing and replicating data, as described in "Enable the master node".

View the peer dashboard

After the restart, log back into the peer node and return to the Clustering page in Splunk Web. This time, you see the peer's clustering dashboard. For information on the dashboard, see "View the peer dashboard".

Configure the peers

After enabling the peers, you need to configure them further before you start indexing data. For details, read these topics:

• "Configure the peer indexes"
• "Use forwarders to get your data"

There are also some advanced configuration options available, as described in "Configure the peer nodes".