https://community.splunk.com/t5/Deployment-Architecture/Adding-a-Search-Head-Help/m-p/33272#M940 <P>Yes, a SH is a good candidate to run in a VM. And it never hurts to build out a distributed environment to handle current needs and future growth. Reference from a previous answer <A href="http://splunk-base.splunk.com/answers/298/can-i-run-splunk-in-a-vm-are-there-any-issues-or-tricks-i-should-be-aware-of">here</A>. Typically you wouldn't move to a stand alone search head until you had at least two indexers though. I would recommend talking to a Splunk sales team that can put you in touch with our Professional services folks who could implement this for you and show you how to scale it in the future.</P> <P>Adding another search head in the future is very straight forward since Splunk has a flexible architecture. The same applies to indexers as well. (<A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch">doc link</A>)</P> <P>Search head pooling may be beneficial depending on your requirements. It certainly allows you to share the configurations and avoid replicating data across your indexers for each new search. </P> <P>You will most likely want to front end multiple search heads with a load balancer and then you can send all users to one place and SH pooling takes care of having all users see what is expected.</P> Tue, 14 May 2013 18:12:41 GMT sdaniels 2013-05-14T18:12:41Z https://community.splunk.com/t5/Deployment-Architecture/Adding-a-Search-Head-Help/m-p/33271#M939 <P>Hi All,</P> <P>Currently I have a standalone splunk (Enterprise). Since the data volume is growing so fast we decided to add a VM as a dedicated Search Head and use the existing one as an indexer, but I have too many questions in order to proceed:<BR /> 1-is it even a good idea to use VM as a dedicated search head?<BR /> 2-in the documents here(<A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Summaryofperformancerecommendations">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Summaryofperformancerecommendations</A>) number of search users are too low. Data volume wise 1 head would be enough for us but number of search users is only 4! right now too many people are using the current Splunk at the same time! <BR /> 3-how much work does it take to add another search head in future? Should I make a pool? How is it going to impact the end users when we are doing it?<BR /> 4-How end users can access the Splunk if we have multiple search heads or indexers. Right now we just access through <A href="https://splunk">https://splunk</A>. <BR /> We are so concerned about scalability and the possible impact if we need to change the configuration in future. We'd rather configure 2 search heads now rather than next year if it impacts our end users!</P> <P>Regards,<BR /> M</P> Tue, 14 May 2013 16:26:27 GMT https://community.splunk.com/t5/Deployment-Architecture/Adding-a-Search-Head-Help/m-p/33271#M939 MarMoh 2013-05-14T16:26:27Z https://community.splunk.com/t5/Deployment-Architecture/Adding-a-Search-Head-Help/m-p/33272#M940 <P>Yes, a SH is a good candidate to run in a VM. And it never hurts to build out a distributed environment to handle current needs and future growth. Reference from a previous answer <A href="http://splunk-base.splunk.com/answers/298/can-i-run-splunk-in-a-vm-are-there-any-issues-or-tricks-i-should-be-aware-of">here</A>. Typically you wouldn't move to a stand alone search head until you had at least two indexers though. I would recommend talking to a Splunk sales team that can put you in touch with our Professional services folks who could implement this for you and show you how to scale it in the future.</P> <P>Adding another search head in the future is very straight forward since Splunk has a flexible architecture. The same applies to indexers as well. (<A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Configuredistributedsearch">doc link</A>)</P> <P>Search head pooling may be beneficial depending on your requirements. It certainly allows you to share the configurations and avoid replicating data across your indexers for each new search. </P> <P>You will most likely want to front end multiple search heads with a load balancer and then you can send all users to one place and SH pooling takes care of having all users see what is expected.</P> Tue, 14 May 2013 18:12:41 GMT https://community.splunk.com/t5/Deployment-Architecture/Adding-a-Search-Head-Help/m-p/33272#M940 sdaniels 2013-05-14T18:12:41Z