Does Splunk support two search head clusters with one indexer cluster?

[ankithreddy777]

Does Splunk support two search head clusters with one indexer cluster? Basically we have 3 search heads clustered. we want to add other 3 search heads which should be separately clustered. Is it possible?

[lgely]

Yes ! You can have 2 Search Head Cluster and only one indexer cluster and request same data from each one

SHC 1 : at least 3 SH + Deployer1
SHC 2 : at least 3 SH + Deployer2
=> you need have one deployer by SHC to deploy apps on SHC 1 and other apps on SHC 2

The difference is in server.conf :
same keypass under [clustering] stanza to exchange with master node of your cluster indexer
but
different keypass under [shclustering] stanza to have 2 SHC

example server.conf on one SH of your new SHC
[shclustering]
conf_deploy_fetch_url = https://ip_deployer2:8089
disabled = 0
mgmt_uri = https://ip_new_sh:8089
pass4SymmKey = < NEW keypass between SH/deployer for your new cluster >
shcluster_label = sh_cluster2
id = XXXXXXXXXXXXXXXXXXXXXXXXXXXX

[clustering]
master_uri = https://same_ip_on_each_SH:8089
mode = searchhead
pass4SymmKey = < same keypass you have on your master node >

[general]
serverName = sh01_cluster2
pass4SymmKey = < same keypass you have on your licence server >

[license]
master_uri = https://same_ip_on_each_SHC:8089

[somesoni2 · Accepted solution]

Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster

[niketn]

Splunk Search Head Clustering requires minimum three search heads.