topic Re: why searchead peering / multi searcheads in Splunk Dev

why searchead peering / multi searcheads

aneriz — Thu, 12 Oct 2017 07:59:02 GMT

Hi, sorry in advanced, im kinda new to splunk.

im wonder, maybe im missing something here
but, why do i need a multi / peering of SH?
as far as i know, SH is a web interface with user/pass authentication.
why not connecting to SH from different clients using the same credentials, that way dashboards and other objects is shared for all users.

thanks!

Re: why searchead peering / multi searcheads

gcusello — Thu, 12 Oct 2017 10:10:03 GMT

Hi aneriz,
what's your question?

SH it isn't only a web interface: it's an application tier that contains apps and related access rules.
To have more SHs is useful when users grow.

So you can have SHs clustered or not: if clustered there's replication of the knowledge objects (dashboards, lookups, fields, etc...) and access rules (users, roles) between SHs; if instead you don't have clustered SHs you must manually align SHs.

Bye.
Giuseppe

Re: why searchead peering / multi searcheads

aneriz — Thu, 12 Oct 2017 18:32:05 GMT

Hi Giuseppe, thanks for replying back 🙂
sorry if i was missunderstood.
I know whats the SH role, but based on your answer - *more SHs is useful when users grow* im asking - why installing more SH instances? its just a matter of load balancing?
why cant i use the same instance, give my multiple users the same URL (my only one) ?
they will authenticate with their credentials and that`s it.
hope my question is more clear.
Thanks!