#Splunk join lookup full

Note: The replication method does not use the configuration replication method described in Configuration updates that the cluster replicates.

#Splunk join lookup full

If you add a new member later, it will get the full set of peers, no matter how they were originally added to the cluster. Peers already added individually will remain in the configuration. You can switch to the replication method at any time. The main circumstance where you might prefer to add peers to individual members is if you already have a cluster and you have automated the process of adding search peers to each member. If you later add a new member to the cluster, it automatically gets the set of peers.It ensures that all members have access to all peers.The replication method is usually preferable, for several reasons: Starting with 6.4, you can add the search peers to just a single member and let the cluster replicate the peer configurations to the other members. You had to add the search peers to each individual member. This is known as search peer replication.īefore Splunk Enterprise 6.4, only the first method was available. Add the search peers to one member and let the cluster replicate the peer configurations to all other cluster members.Add the search peers to each member individually.You can add non-clustered search peers in two ways: Search head cluster with non-clustered indexers See Use indexer clusters to scale indexing in the Managing Indexers and Clusters of Indexers manual. This topology also provides numerous other benefits from a management perspective. Just incorporate your set of indexers into an indexer cluster with a replication factor of 1. See Integrate the search head cluster with an indexer cluster.Įven if you do not need the benefits of index replication, you can still take advantage of this simple approach to configuring the set of search peers. Once you configure the search head cluster members so that they participate in the indexer cluster, you do not need to perform any further configuration for the search heads to know their search peers. If the search head cluster is connected to an indexer cluster, the manager node on the indexer cluster provides the search heads with a list of peer nodes to search against. In other words, a cluster member cannot be a search peer of the cluster. Important: Cluster members cannot distribute searches to other cluster members. The search head cluster will be running against individual, non-clustered indexers.The search head cluster will be running against an indexer cluster.How the search heads find out about their search peers depends on whether the search head cluster is part of an indexer cluster.

All members of a cluster must have access to the same set of search peers. Connect the search heads in clusters to search peersīefore the search heads in the cluster can run searches, they need to know the identity of their indexers, or search peers.