topic Add a standalone search head in Installation

Add a standalone search head

jwilliams — Sun, 23 Aug 2020 23:14:16 GMT

Hello,

I have a single splunk indexer. How do I add a search head? I do not have an index cluster. At this time I have a single indexer but may go to two indexers. Documentation talks about index cluster which I do not have.

My simple goal was to have a search head and a indexer or two indexers.

This is a new user type question running version 8.

Thanks in Advance,

Jim

Re: Add a standalone search head

sduff_splunk — Mon, 24 Aug 2020 00:09:32 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Configuredistributedsearch

Probably the easiest way to do this is via the Search Head's WebGUI. Log in as an admin, and go to Settings > Distributed Search. Then click on Search Peers. Provide your indexer's IP or FQDN, https://indexer_address:8089 and admin credentials for the indexer. Click Save, and you will have linked the search head with the indexer.

You can also use CLI or .conf files to do so, but I think the WebGUI illustrates it best.