https://community.splunk.com/t5/Deployment-Architecture/Help-setting-up-a-search-head-cluster/m-p/316376#M11948 <P>New to Splunk, can anyone help me build a SH Cluster? Any videos would be great, I tried reading the tutorials on Splunk but i'm still confused. I already have a practice environment setup.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/SHCdeploymentoverview">http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/SHCdeploymentoverview</A></P> Sat, 02 Sep 2017 01:06:03 GMT bofa123 2017-09-02T01:06:03Z https://community.splunk.com/t5/Deployment-Architecture/Help-setting-up-a-search-head-cluster/m-p/316376#M11948 <P>New to Splunk, can anyone help me build a SH Cluster? Any videos would be great, I tried reading the tutorials on Splunk but i'm still confused. I already have a practice environment setup.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/SHCdeploymentoverview">http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/SHCdeploymentoverview</A></P> Sat, 02 Sep 2017 01:06:03 GMT https://community.splunk.com/t5/Deployment-Architecture/Help-setting-up-a-search-head-cluster/m-p/316376#M11948 bofa123 2017-09-02T01:06:03Z https://community.splunk.com/t5/Deployment-Architecture/Help-setting-up-a-search-head-cluster/m-p/316377#M11949 <P>Hi bofa123,<BR /> I deployed a search Head Cluster following instructions on documentation at <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/AboutSHC" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/AboutSHC</A><BR /> I found only a problem (not documented in docs but in answers), described above </P> <P>Shortly:</P> <P>Deployer Configuration</P> <UL> <LI>Search Head Cluster Label Configuration: <UL> <LI>in etc/system/local/server.conf file insert [shclustering] stanza</LI> <LI>In that stanza insert row shcluster_label = my_cluster_label</LI> </UL></LI> <LI>Deployer's security key configuration: <UL> <LI>In etc/system/local/server.conf file, insert own password (not encrypted) in row “pass4SymmKey” of [general] or [shclustering] stanza, at first restart Splunk will encrypt it</LI> </UL></LI> <LI>Restart Splunk</LI> </UL> <P>Cluster Members Configuration </P> <UL> <LI>run command <UL> <LI>splunk init shcluster-config -auth ‘admin:password’ -mgmt_uri <A href="https://server_address:8089" target="_blank">https://server_address:8089</A> -replication_port 8079 -replication_factor 3 -conf_deploy_fetch_url <A href="https://deployer_address:8089" target="_blank">https://deployer_address:8089</A> -shcluster_label shcluster1</LI> <LI>BEWARE: don't set –secret=password parameter (it's described in documentation!) because don't run!</LI> </UL></LI> <LI>splunk restart</LI> <LI>modify in /opt/splunk/etc/system/local/server.conf file row pass4SymmKey inserting secret password in clear</LI> <LI>splunk restart</LI> </UL> <P>Captain Configuration</P> <UL> <LI>Choose Captain</LI> <LI>go on Captain</LI> <LI>run command <UL> <LI>splunk bootstrap shcluster-captain -servers_list "<A href="https://Server1_IP:8089" target="_blank">https://Server1_IP:8089</A>, <A href="https://Server2_IP:8089" target="_blank">https://Server2_IP:8089</A>" -auth admin:password</LI> </UL></LI> </UL> <P>Adding Search Peers</P> <UL> <LI>Distributed Search Configuration</LI> <LI>Add Peer 1</LI> <LI>URI peer <A href="https://Indexer_1_IP:8089" target="_blank">https://Indexer_1_IP:8089</A></LI> <LI>Remote User Service_User_On_Indexer_1</LI> <LI>Remore Password Service_User_On_Indexer_1 password</LI> <LI>Confirm Password on so on</LI> </UL> <P>Thn copy your Apps on Deployer and deploy them using Deployer.<BR /> All following updates will be automatically deployed by Cluster.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 29 Sep 2020 15:34:56 GMT https://community.splunk.com/t5/Deployment-Architecture/Help-setting-up-a-search-head-cluster/m-p/316377#M11949 gcusello 2020-09-29T15:34:56Z