topic Re: Making search head clustering in Deployment Architecture

Making search head clustering

graju89 — Wed, 20 Mar 2019 21:02:41 GMT

Hi,

I need step to step process of adding new search head into my splunk instances. My splunk setup as follows:
1. one search head
2. one deployment server
3. three search peers.

So i am adding another search head that means I have ti create a search head cluster and do the configuration. Can any one help me with the complete step?

Thanks.

Re: Making search head clustering

ChrisG — Wed, 20 Mar 2019 21:29:25 GMT

Have you read the docs already? There is extensive information about search head clustering, starting with About search head clustering in the Distributed Search manual. See also Search head clustering architecture and Deploy a search head cluster, among many other topics in that manual.

Re: Making search head clustering

richgalloway — Wed, 20 Mar 2019 21:32:57 GMT

You must have at least three search heads to create a search head cluster (SHC). You will also need a search head deployer, which possibly can be done by your deployment server.

However, just because you have more than one search head does not mean you need a SHC. You can have two independent search heads, but they won't share capacity and will be harder to manage.

If you still want an SHC, Splunk docs explain how to do it at https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/SHCdeploymentoverview.

Re: Making search head clustering

graju89 — Wed, 20 Mar 2019 22:06:37 GMT

@richgalloway Hi, I will have only two search head. Don't I need SHC?

Re: Making search head clustering

ChrisG — Wed, 20 Mar 2019 22:41:21 GMT

Not with two search heads, no. Quoting from System requirements and other deployment considerations for search head clusters:

The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

Three members, so that the cluster can continue to function if one member goes down. See Captain election process has deployment implications.
The replication factor number of instances. See Choose the replication factor for the search head cluster.

For example, if your replication factor is either 2 or 3, you need at least three instances.

Re: Making search head clustering

RohitMu — Thu, 21 Mar 2019 02:56:55 GMT

This cheat sheet is helpful
https://www.aplura.com/wp-content/uploads/2017/08/shc_cheatsheet.pdf

Re: Making search head clustering

graju89 — Thu, 21 Mar 2019 15:29:12 GMT

@ChrisG Thank you so much.

Re: Making search head clustering

graju89 — Tue, 26 Mar 2019 17:23:42 GMT

@ChrisG @richgalloway I am having trouble in finding the security key when adding the new search head into the cluster. Do you know where I can or how I can get the security key when adding the new search head into clustering.

Thanks,

Re: Making search head clustering

sloshburch — Tue, 07 May 2019 19:30:23 GMT

I think you are refering to the pass4SymmKey. Review to Set up the deployer