https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175219#M50297 <P>I remember seeing a press on conf2013 about this as well. Basically, only the knowledge items need to be shared on the search heads.</P> Thu, 06 Mar 2014 19:30:20 GMT hvandenb 2014-03-06T19:30:20Z https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175215#M50293 <P>We're setting up an Index Cluster with a Master Node. From the documentation it looks like the Cluster will take care of replicating data and configuration between the Indexers. However, we're also wanting to have multiple search heads that work with the cluster. </P> <P>What have people used to setup the search heads behind a load balancer. Do we need to use shared storage for the search heads or is there better configuration?</P> Wed, 05 Mar 2014 17:33:36 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175215#M50293 hvandenb 2014-03-05T17:33:36Z https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175216#M50294 <P>you're looking for search head pooling: <A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuresearchheadpooling">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuresearchheadpooling</A></P> Wed, 05 Mar 2014 20:02:57 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175216#M50294 martin_mueller 2014-03-05T20:02:57Z https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175217#M50295 <P>Thanks for the answer. I'd like to avoid using shared storage as this adds complexity. I heard that some folks rsync knowledge bundles between search heads. We don't plan on running scheduled searches on the search heads, but rather have a separate server for that.<BR /> Have you seen this as an option?</P> Thu, 06 Mar 2014 16:11:40 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175217#M50295 hvandenb 2014-03-06T16:11:40Z https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175218#M50296 <P>@gkanapathy did mention something similar to that in his Architecting for Scale talk at .conf 2012, maybe he can shed some light on viable alternatives to search head pooling.</P> Thu, 06 Mar 2014 18:05:18 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175218#M50296 martin_mueller 2014-03-06T18:05:18Z https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175219#M50297 <P>I remember seeing a press on conf2013 about this as well. Basically, only the knowledge items need to be shared on the search heads.</P> Thu, 06 Mar 2014 19:30:20 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Search-Heads-in-a-Cluster/m-p/175219#M50297 hvandenb 2014-03-06T19:30:20Z