https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431035#M75441 <P>@nickhillscpl Thank you for the reply.</P> <P>In that case won't we have 2 search heads? And we don't want our URL to change as it is pretty standard across the organization. Is there a way we can use the old URL?</P> Wed, 13 Mar 2019 16:28:36 GMT pdantuuri0411 2019-03-13T16:28:36Z https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431033#M75439 <P>In our small Splunk environment, we have the search head and the indexer on the same server box. Due to performance issues, we are thinking of giving the search head a separate server box.</P> <P>What steps should be followed in this process? Is there any good documentation for this.</P> <P>Thank you</P> Wed, 13 Mar 2019 15:14:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431033#M75439 pdantuuri0411 2019-03-13T15:14:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431034#M75440 <P>You want to move to a distributed deployment.</P> <P>This is actually quite straightforward. You simply use your existing Splunk deployment as the 'Indexer' (or 'Search Peer'), and a new 'Search Head' to it.</P> <P>Build yourself a new server, download and install (the same version) of Splunk and install it. Then follow the following guide to add your existing 'Search Peer' to your new 'Search Head'<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/Configuredistributedsearch">https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/Configuredistributedsearch</A></P> <P>Once you have completed that, you can copy your existing Apps to the new SH, test and share the new URL with your users.</P> Wed, 13 Mar 2019 15:27:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431034#M75440 nickhills 2019-03-13T15:27:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431035#M75441 <P>@nickhillscpl Thank you for the reply.</P> <P>In that case won't we have 2 search heads? And we don't want our URL to change as it is pretty standard across the organization. Is there a way we can use the old URL?</P> Wed, 13 Mar 2019 16:28:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431035#M75441 pdantuuri0411 2019-03-13T16:28:36Z https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431036#M75442 <P>Technically yes, but every indexer/cluster master/heavy forwarder is still a SH. The difference is that you just want to stop using it as one. </P> <P>If you have a nice url like Splunk.mycompany.com hopefully that is a CName for your server? <BR /> In which case you can just change the alias when you have finished testing. </P> <P>If on the other hand, the url is the actual hostname of your Splunk server, now is a good time to break that dependency and introduce a CName as an alias. </P> <P>Running Splunk via a hostname restricts you in the future as your deployment grows so you are better of changing it sooner. </P> Wed, 13 Mar 2019 16:48:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-isolate-the-indexer-and-search-head-from-the-same-server/m-p/431036#M75442 nickhills 2019-03-13T16:48:51Z