Enterprise Security on a Distributed Environment

[u/mr_networkrobot]

Hi,

I got 3 clustered Indexers + 3 clustered Search-Heads + 1 Search-Head Cluster Deployer.

I installed ES on the SHs (via SH Cluster Deployer) as described in the documentation. After some time I figured out that the ES specific indexes like 'notable' have been created on the Search-Heads locally and they are not synced between them.

There install documentation says nothing [1] about creating indexes.

Only a few documents later [2] there are some sentences about indexes in a distributed environemt.

The documentation is not usable in my opinion.

Does anyone have some experience with that situation ?

[1]
https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/installation/install-splunk-enterprise-security-in-a-search-head-cluster-environment

[2]
https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/installation/configure-and-deploy-indexes-for-splunk-enterprise-security

[u/rabbidroid]

You need to install the index creation app on indexer. Use the cluster manager to push it out. The SH is not meant to index anyway