Summary
In this chapter, we learned that distributed search separates the duties of search heads and indexers. Search heads accept search requests from users and distribute them to indexers that are preconfigured. Search results returned from indexers will be consolidated by the search head and presented to the user.
We looked at the advantages of search head clusters compared to standalone instances and indexer cluster architectures. The search head captain plays a vital role in distributing knowledge bundles, scheduling searches, artifact proxying, and more. A dedicated cluster manager in the indexer cluster replicates data copies and ensures the search factor is met.
After this, we went through the ways to configure distributed search on a search head using the Splunk Web and CLI approaches. After configuring distributed search, we examined knowledge bundles, what they contain, and how to minimize their size through the max bundle size and deny list settings, along with ways...
