Deployment Architecture

Additional Search head apart from SH Cluster -Will it work?

Path Finder

Hello all,

I have Index cluster in and SH cluster in our environment. All of them are 7.x version. Now I want to add an additional Search head (v8.0) , which will talk to Index cluster but this will not be a part of SH cluster. It will act as a standalone SH, and it will contain separate data models.

Will splunk support above architecture?



0 Karma


Depending on your exact version of splunk only recently shared data model accelerations became a feature. Even with that you will have to be responsible for ensuring all configurations are replicated on the stand alone for parsing lookups etc. Otherwise as stated above check compatibility matrix between versions to ensure the SH can talk to older indexers. I expect it should be ok.

0 Karma

Path Finder

yes , just add it as a search head to the cluster master
but check the splunk version compatibility

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...