Deployment Architecture

Distributed Deployment

mandarpimplapur
Explorer

Dear Team,

We have a splunk 5.x version setup in our Office Environment as follows:

Splunk Server with "N" number of Forwarders.

Now, we need to add one new box with search heads and the splunk servers will act as Indexers.

Will it be possible ? Am i on right track.

Thanks in advance.

Tags (1)
0 Karma
1 Solution

gfreitas
Builder

Hi,

To add a Search Head to your installation, install Splunk Enterprise and follow the following procedure: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch.
Now, any search you run on your search head will be distributed to your search peers (Indexers).

View solution in original post

ddrillic
Ultra Champion

Makes perfect sense. The current server can function as the indexer and the new one(s) would be the search heads.

The best practice when moving from one Splunk server to multiple servers, is to keep the original server as the indexer, as you planned on doing.

alt text

gfreitas
Builder

Hi,

To add a Search Head to your installation, install Splunk Enterprise and follow the following procedure: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch.
Now, any search you run on your search head will be distributed to your search peers (Indexers).

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...