I need to install S.o.S - Splunk on Splunk to monitor a Multisite Indexer Cluster and Searh Head Cluster:
2 Sites with 2 Peers Each
3 SH on the SH Cluster
Master and Deployer reside on the same VM.
The documentation that's available on Splunk Docs for Planning the SOS installation does not cover SH Cluster.
In addition to the Splunk Answer that @sk314 points out, I will indicate that as of right now S.o.S has not been certified to work without a hitch on a search-head cluster.
I would expect that the app will work fine, with one exception: It's dynamically generated lookups which are used as asset tables and are maintained on a per-instance basis which may not be entirely compatible with an SHC.
In order to circumvent that, you'll probably need to do something like this:
*.xmlin the app's
default/data/ui/views. This can be accomplished with the
disable_FTR.shscript located in that directory.
$SPLUNK_HOME/etc/apps/sos/lookups/splunk_servers_cache.csvtable manually instead, following the specifications recorded in
I would advise against use sos be instead configure Distributed Management Console. The DMC has a lot more information and is more responsive. Works well with clustered search heads and indexers. It really easy to setup
A fine point indeed, @bmacias84! If you are running Splunk 6.1 or above, you should be setting up a Distributed Management Console to monitor your Splunk deployment.
I recently installed S.o.S on our clustered Splunk(6.2) instance. As per @bmacias84, I went ahead and configured DMC. It's really cool! Thanks for the tip.