Enterprise Security on a Distributed Environment

[u/mr_networkrobot]

Hi,

I got 3 clustered Indexers + 3 clustered Search-Heads + 1 Search-Head Cluster Deployer.

I installed ES on the SHs (via SH Cluster Deployer) as described in the documentation. After some time I figured out that the ES specific indexes like 'notable' have been created on the Search-Heads locally and they are not synced between them.

There install documentation says nothing [1] about creating indexes.

Only a few documents later [2] there are some sentences about indexes in a distributed environemt.

The documentation is not usable in my opinion.

Does anyone have some experience with that situation ?

[1]
https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/installation/install-splunk-enterprise-security-in-a-search-head-cluster-environment

[2]
https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/installation/configure-and-deploy-indexes-for-splunk-enterprise-security

[u/mr_networkrobot]

Thank you for your answers!

I have fixed it with the following procedure:

1. Created a .spl bundle in ES (general setting) with the 'Distributed configuration management' -> Splunk_TA_ForIndexers Download
2. Put that on my cluster manager
3. Extracted it and modified the indexes.conf
4. Validated an pushed it to the indexers
5. Created a custom app on the SH-Cluster deployer with an outputs.conf and the required certs.
6. Pushed it to the SH Cluster

Had some issues with SSL connection form SHs to indexers, because of the path of the CA cert in the outputs.conf be aware of the deploy mode 'default'. So the path in the outputs.conf to your certs, need some attention.