Currently, our Splunk dev environment consists of a standalone instance that is both our indexer and search head.
What I am trying to do is set up a new search head that will connect to our production environment indexer, essentially mimicking production in development. I have a brand new instance that I just got set up that will act as a standalone search head.
From here, would I add the indexer as a search peer in a distributed search?
I'm only about a week into learning Splunk, so this stuff definitely confuses me a bit which is why I decided to ask on here.
Please let me know what you guys think is the best solution here.
You have it right. Go to Settings->Distributed search and add the existing indexer as a search peer.
Keep in mind that every search run on the two search heads takes up a CPU on the indexer so be careful not to allow Dev to affect the performance of Prod by running a lot of searches and using up resources on the indexer.
--- If this reply helps you, an upvote would be appreciated.