I need to install S.o.S - Splunk on Splunk to monitor a Multisite Indexer Cluster and Searh Head Cluster:
2 Sites with 2 Peers Each
3 SH on the SH Cluster
Master and Deployer reside on the same VM.
The documentation that's available on Splunk Docs for Planning the SOS installation does not cover SH Cluster.
I would advise against use sos be instead configure Distributed Management Console. The DMC has a lot more information and is more responsive. Works well with clustered search heads and indexers. It really easy to setup
In addition to the Splunk Answer that @sk314 points out, I will indicate that as of right now S.o.S has not been certified to work without a hitch on a search-head cluster.
I would expect that the app will work fine, with one exception: It's dynamically generated lookups which are used as asset tables and are maintained on a per-instance basis which may not be entirely compatible with an SHC.
In order to circumvent that, you'll probably need to do something like this:
*.xmlin the app's
default/data/ui/views. This can be accomplished with the
disable_FTR.shscript located in that directory.
$SPLUNK_HOME/etc/apps/sos/lookups/splunk_servers_cache.csvtable manually instead, following the specifications recorded in