Use an external Indexer Cluster

Connect Splunk Operator resources to an external indexer cluster.

Configure Splunk Operator Standalone, SearchHeadCluster, and LicenseManager resources to use an external indexer cluster by sharing IDXC pass4Symmkey and configuring the cluster manager URL. Share the same indexer clustering pass4Symmkey between the global secret object and the external cluster manager and indexers, and configure splunk.cluster_master_url.

Note:

This procedure requires Splunk Enterprise container version 8.1.0 or higher.

  1. Configure IDXC pass4Symmkey (approach 1): set matching values in the global secret and on the cluster manager and indexers.
    • Set up the desired plain-text IDXC pass4Symmkey in the global secret object (stored base64 encoded).
    • Set up the same plain-text value in the [clustering] section of server.conf on the cluster manager and on the indexers.
  2. Configure IDXC pass4Symmkey (approach 2): copy the value from the cluster manager or indexers into the global secret.

    Retrieve the plain-text value from the [clustering] stanza of server.conf. If the value is encrypted, decrypt it with:

    CODE 
    $SPLUNK_HOME/bin/splunk show-decrypted --value '...'

    Set up the decrypted value in the global secret object.

  3. Configure cluster_master_url through default.yml and a Kubernetes secret.

    Create default.yml with the cluster manager host or URL:

    CODE 
    splunk:
  cluster_master_url: cluster-manager.splunk.mydomain.com

    Save the file as a secret:

    CODE 
    kubectl create secret generic splunk-cluster-manager --from-file=default.yml

    Reference the secret and set defaultsUrl on the SearchHeadCluster resource:

    CODE 
    apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: example
  namespace: splunk-operator
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  volumes:
    - name: cluster-manager
      secret:
        secretName: splunk-cluster-manager
  defaultsUrl: /mnt/cluster-manager/default.yml