Deployment Architecture

How to connect a standalone search head to an indexer cluster?

Path Finder


I have a standalone search head which is not a part of an indexer cluster. In this case, do I need to point the search head to the master node of the cluster, or do I need to point it to the peer nodes? (What I am thinking is I should point it to the master node)

0 Karma
1 Solution

Path Finder

Does my answer above solve your question ? If yes, spare a moment to accept the answer and vote for it. Thanks.

0 Karma

Path Finder

Steps to setup a Search Head

You can install one or more search heads to handle your distributed search needs. Search heads are just full Splunk Enterprise instances that have been specially configured.
You can setup search head either from Splunk web interface or using the command line as follows.
Enable search peers in search heads by navigating to Settings -> Distributed Search -> Search peers - > New & add indexer IP Address to talk to. Make sure to have the unique server name for each member of the cluster. User can do it in two ways as below:
1) From Splunk GUI under Settings -> Server settings -> General Settings update the field "Splunk server name".
2) Edit the field "serverName" in the /etc/system/local/server.conf file and then restart the Splunk.

Hope this helps !

0 Karma


This isn't how you add an SH to an indexer cluster.

0 Karma


Master Node is the correct because it will coordinate wich indexer the search head will search. If you point the indexers you will see duplicated data.

0 Karma


This one is the correct way.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...