Adding New Search Head Peers to Search Head Deployer and New Indexers to Cluster Master

[Pawlub1]

Hi all,

We need to add a couple dozen new search head peers to search head deployer, as well as adding a couple dozen indexers to a cluster master and would like to script this implementation. 

I need to know what configuration files need to be modified to join these new search head peers and indexer to the existing Splunk environment. 

We are plan on running an Ansible script for this implementation project. 

/Paul

[richgalloway]

I strongly encourage you to use CLI commands to add cluster members rather than editing config files.  The commands will update config files for you.  If you edit the files yourself then Splunk must be restarted for the edits to take effect.

To add a SHC member, see https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/Addaclustermember#Add_the_instance

To add an indexer to a cluster, see https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Addclusterpeer

[isoutamo]

Hi

here https://github.com/splunk/splunk-ansible is one way to use ansible to install splunk environment.

With ansible you could use both ways to add nodes to cluster (edit conf files + restart nodes and/or use cli commands).  Which one is better way is different story which depends on your needs and used software.

As you need to add several nodes now (and probably more later) scripting is definitely the correct way to manage that. Personally I install even individual nodes with ansible. And of course you should use e.g. git to store your configuration and versioning it.

r. Ismo