I have a distributed non-clustered Splunk Enterprise environment. I am planning to implement Search Head clustering and a multisite indexer cluster. I know that the current Nix and Windows Infra apps haven't been certified yet by Splunk in a SH cluster, and there could be limited support from Splunk in the event of an issue.
I am sure there are users that have deployed the Apps in a SH cluster. Are there any caveats that people have seen on the deployment of the current shipping applications in a Splunk 6.3 SH cluster?
i've basically found that no splunk supported app works with shclustering no matter how much effort you put into it. don't waste your time.