Deployment Architecture
Highlighted

How do you add a new Search Head to Splunk Monitoring Console?

Legend

Hi at all,

I have a distributed environment with a Search Head Cluster, some indexers. Deployment Server and I can see all the servers in the Monitoring Console(MC).
Now I added a Stand Alone Search Head (it's a Development System not integrated in the cluster) but I don't see it in MC.
The Search Head(SH) forwards its logs to the Indexers.
If I manually add this SH to the assets.csv lookup I see it in MC Overview but receive the following message "1 instances unreachable" and I haven't information about it.
If I go in [Settings -- General Setup -- Apply Changes] the added SH disappears.

How can I see it in MC?

Thank you in advance

Bye.
Giuseppe

0 Karma
Highlighted

Re: How do you add a new Search Head to Splunk Monitoring Console?

You have to add the new instance under distributed search on the DMC instance. Settings -> Distributed search -> Search peers -> New.

Doc: http://docs.splunk.com/Documentation/Splunk/7.0.2/DMC/Addinstancesassearchpeers

Jacob
Sr. Technical Support Engineer

View solution in original post

Highlighted

Re: How do you add a new Search Head to Splunk Monitoring Console?

Explorer

That's not working for me, I've added all the 3 search heads of the shcluster as peernodes, but they still don't show up in the Monitoring Console Overview

0 Karma
Highlighted

Re: How do you add a new Search Head to Splunk Monitoring Console?

Contributor
You must also add and configure those on MC’s general setting page. Then apply configuration and then those should be there.
R. Ismo
Highlighted

Re: How do you add a new Search Head to Splunk Monitoring Console?

Explorer

Thanks, that's fixed it.

There's really no way to do that automated - i.e. by changing stanzas in the server.conf?
I'd like to automate the cluster setup and avoid any manual steps.

0 Karma
Highlighted

Re: How do you add a new Search Head to Splunk Monitoring Console?

Contributor
Those search peers can added e.g. with ansible (or other scripts), but unfortunately at least I haven't found any reasonable way to do that last part within MC. Basically that is doable (but probably it changes later on), but as it's not supported and this is mainly (excl. cluster peers) one time task I haven't use my time to resolve it (yet).

r. Ismo
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.