I need step to step process of adding new search head into my splunk instances. My splunk setup as follows:
1. one search head
2. one deployment server
3. three search peers.
So i am adding another search head that means I have ti create a search head cluster and do the configuration. Can any one help me with the complete step?
You must have at least three search heads to create a search head cluster (SHC). You will also need a search head deployer, which possibly can be done by your deployment server.
However, just because you have more than one search head does not mean you need a SHC. You can have two independent search heads, but they won't share capacity and will be harder to manage.
If you still want an SHC, Splunk docs explain how to do it at https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/SHCdeploymentoverview.
Not with two search heads, no. Quoting from System requirements and other deployment considerations for search head clusters:
The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:
For example, if your replication factor is either 2 or 3, you need at least three instances.
@ChrisG @richgalloway I am having trouble in finding the security key when adding the new search head into the cluster. Do you know where I can or how I can get the security key when adding the new search head into clustering.