We are building a single-site pilot environment with the following layout:
1 x Deployment and License Manager
3 x Search heads (configured in a SH cluster)
3 x Indexers
1 x Indexer Cluster Master
We have the indexers set up and sharing data and we even have a test forwarder sending data to an index on those clusters, however, when we connect to the search heads (either directly or via our load-balanced IP in front of them) the search does not see any data whether from the internal indexes or the external test index we built for our test data.
We ran the `/opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list` command and listed all of our search heads. We also ran the `/opt/splunk/bin/splunk edit cluster-config-mode searchhead -master_uri` on the captain.
We've read through the http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexerclusterdocumentation but we're not clear whether we need to run `edit cluster-config -mode searchhead -master_uri` command on each of the search heads. That is what we've done, but it doesn't appear to resolve the issue.
↧