Deployment Architecture

Adding a search head to a search head cluster, do we need to do anything else other than adding the same configurations as existing members?

merter
New Member

Hi Splunk experts!

We have a Splunk Enterprise Search Head Cluster with 3 Search Heads.
We need more cores, so we're adding a 4th physical server.

Is there anything special we need to do besides give it the same config as the other Search Heads? This is the first time since we built the Search Head Cluster that we have added an additional Search Head into it.

Thanks!

0 Karma

Steve_G_
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...