topic Re: Additional Search Head for Splunk in Splunk Cloud Platform

Additional Search Head for Splunk

anandhalagaras1 — Wed, 14 Oct 2020 13:37:02 GMT

Hi Team,

Currently we are using Splunk Cloud in our organization. i.e. We have a dedicated Search head for ES and another Adhoc search head for rest of the applications.

So we need an additional search head for development and testing purpose. i.e. All the index logs should be visible and searchable in the additional search head So do we need to contact Splunk Support on this to host the same in Cloud and also we want to know will there be any cost involved as well.

Or else do we have any option something like that we can build a new server in Azure and install the Splunk package into it (Additional Search Head) and can we integrate with Splunk Cloud so that all the index logs should be searchable & visible. So that before going directly into production we will perform a testing in the development environment.

We want a solution that should be cost effective since we majorly use it for development purpose.

Kindly help to address on my query.

Re: Additional Search Head for Splunk

thambisetty — Wed, 14 Oct 2020 14:08:04 GMT

Hope you have Splunk cloud support. I advise you to open a case with Splunk support. They will be able to give you quotation for that.

Re: Additional Search Head for Splunk

anandhalagaras1 — Wed, 14 Oct 2020 14:13:37 GMT

@thambisetty ,

Thank you for your response. But by any chance can we deploy a search head in on-prem (Azure) and integrate with Splunk Cloud?

Do you have any thoughts on it.

Re: Additional Search Head for Splunk

thambisetty — Wed, 14 Oct 2020 14:19:31 GMT

I have Splunk cloud deployment in AWS and it's completely managed by Splunk cloud support. I have never come across this problem ( this seems to be design & architecting problem). I hope definitely Splunk cloud supports to have one more instance in cloud, but I doubt if they allow you to connect to Splunk cloud indexers from your own Splunk Enterprise.

But, I would highly recommend you to create a Splunk support case.