Additional Search head apart from SH Cluster -Will it work?

[sahabhi606]

Hello all,

I have Index cluster in and SH cluster in our environment. All of them are 7.x version. Now I want to add an additional Search head (v8.0) , which will talk to Index cluster but this will not be a part of SH cluster. It will act as a standalone SH, and it will contain separate data models.

Will splunk support above architecture?

Thanks.

Regards,
Abhi

[starcher]

Depending on your exact version of splunk only recently shared data model accelerations became a feature. Even with that you will have to be responsible for ensuring all configurations are replicated on the stand alone for parsing lookups etc. Otherwise as stated above check compatibility matrix between versions to ensure the SH can talk to older indexers. I expect it should be ok.

[jarizeloyola]

yes , just add it as a search head to the cluster master
but check the splunk version compatibility
https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/Distsearchsystemrequirements