https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251261#M9502 <P>Steps to setup a Search Head</P> <P>You can install one or more search heads to handle your distributed search needs. Search heads are just full Splunk Enterprise instances that have been specially configured.<BR /> You can setup search head either from Splunk web interface or using the command line as follows.<BR /> Enable search peers in search heads by navigating to Settings -&gt; Distributed Search -&gt; Search peers - &gt; New &amp; add indexer IP Address to talk to. Make sure to have the unique server name for each member of the cluster. User can do it in two ways as below:<BR /> 1) From Splunk GUI under Settings -&gt; Server settings -&gt; General Settings update the field "Splunk server name".<BR /> 2) Edit the field "serverName" in the /etc/system/local/server.conf file and then restart the Splunk.</P> <P>Hope this helps ! </P> Fri, 02 Jun 2017 10:07:33 GMT nit123 2017-06-02T10:07:33Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251257#M9498 <P>Hello</P> <P>I have a standalone search head which is not a part of an indexer cluster. In this case, do I need to point the search head to the master node of the cluster, or do I need to point it to the peer nodes? (What I am thinking is I should point it to the master node)</P> Mon, 11 Jul 2016 13:56:00 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251257#M9498 saifuddin9122 2016-07-11T13:56:00Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251258#M9499 <P>Here you go<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Configuresearchheadwithserverconf">http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Configuresearchheadwithserverconf</A></P> Mon, 11 Jul 2016 14:03:58 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251258#M9499 somesoni2 2016-07-11T14:03:58Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251259#M9500 <P>Master Node is the correct because it will coordinate wich indexer the search head will search. If you point the indexers you will see duplicated data.</P> Mon, 11 Jul 2016 14:05:44 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251259#M9500 gfreitas 2016-07-11T14:05:44Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251260#M9501 <P>This one is the correct way.</P> Mon, 11 Jul 2016 14:08:44 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251260#M9501 TStrauch 2016-07-11T14:08:44Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251261#M9502 <P>Steps to setup a Search Head</P> <P>You can install one or more search heads to handle your distributed search needs. Search heads are just full Splunk Enterprise instances that have been specially configured.<BR /> You can setup search head either from Splunk web interface or using the command line as follows.<BR /> Enable search peers in search heads by navigating to Settings -&gt; Distributed Search -&gt; Search peers - &gt; New &amp; add indexer IP Address to talk to. Make sure to have the unique server name for each member of the cluster. User can do it in two ways as below:<BR /> 1) From Splunk GUI under Settings -&gt; Server settings -&gt; General Settings update the field "Splunk server name".<BR /> 2) Edit the field "serverName" in the /etc/system/local/server.conf file and then restart the Splunk.</P> <P>Hope this helps ! </P> Fri, 02 Jun 2017 10:07:33 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251261#M9502 nit123 2017-06-02T10:07:33Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251262#M9503 <P>Does my answer above solve your question ? If yes, spare a moment to accept the answer and vote for it. Thanks.</P> Sat, 15 Jul 2017 13:42:48 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251262#M9503 nit123 2017-07-15T13:42:48Z https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251263#M9504 <P>This isn't how you add an SH to an indexer cluster.</P> Tue, 18 Dec 2018 15:51:18 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-connect-a-standalone-search-head-to-an-indexer-cluster/m-p/251263#M9504 twinspop 2018-12-18T15:51:18Z