Help setting up a search head cluster?

[bofa123]

New to Splunk, can anyone help me build a SH Cluster? Any videos would be great, I tried reading the tutorials on Splunk but i'm still confused. I already have a practice environment setup.

http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/SHCdeploymentoverview

[gcusello]

Hi bofa123,
I deployed a search Head Cluster following instructions on documentation at http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/AboutSHC
I found only a problem (not documented in docs but in answers), described above

Shortly:

Deployer Configuration

• Search Head Cluster Label Configuration:
  • in etc/system/local/server.conf file insert [shclustering] stanza
  • In that stanza insert row shcluster_label = my_cluster_label
• Deployer's security key configuration:
  • In etc/system/local/server.conf file, insert own password (not encrypted) in row “pass4SymmKey” of [general] or [shclustering] stanza, at first restart Splunk will encrypt it
• Restart Splunk

Cluster Members Configuration

• run command
  • splunk init shcluster-config -auth ‘admin:password’ -mgmt_uri https://server_address:8089 -replication_port 8079 -replication_factor 3 -conf_deploy_fetch_url https://deployer_address:8089 -shcluster_label shcluster1
  • BEWARE: don't set –secret=password parameter (it's described in documentation!) because don't run!
• splunk restart
• modify in /opt/splunk/etc/system/local/server.conf file row pass4SymmKey inserting secret password in clear
• splunk restart

Captain Configuration

• Choose Captain
• go on Captain
• run command
  • splunk bootstrap shcluster-captain -servers_list "https://Server1_IP:8089, https://Server2_IP:8089" -auth admin:password

Adding Search Peers

• Distributed Search Configuration
• Add Peer 1
• URI peer https://Indexer_1_IP:8089
• Remote User Service_User_On_Indexer_1
• Remore Password Service_User_On_Indexer_1 password
• Confirm Password on so on

Thn copy your Apps on Deployer and deploy them using Deployer.
All following updates will be automatically deployed by Cluster.

Bye.
Giuseppe