We have a multisite cluster which has search head clustering configured and all is working fine. I want to add a single search head to the cluster (not to the shcluster), but need to be site aware. Using local search peers on site1 and only using other sites 2 & 3 if site1 is not available.
Hi Smudge, I think this link can help you: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Configuremulti-clustersearch