Deployment Architecture

How to properly replace search heads in a search head cluster?



I have 20+ 8 CPU search heads. Going to be installing 24 CPUs search heads and retiring these old ones that are currently configured in a search head cluster.

Basic plan is to add them to the pool, wait a day, then remove the old ones. Anything in there I am forgetting? Any special tuning to make Splunk realize the new search heads have more cores?

0 Karma

Splunk Employee
Splunk Employee

SHC wont recognize different cores across the cluster. It currently assumes what the captain has, all the other members have. So it's best to pull out all the lower spec machines ASAP.

I'd recommend adding them to the SHC, and make sure that once you have added them, make sure the captain is still the lower CPU count member. Then after you have the all added, remove as many of the old ones as possible, then force a captain on the higher cpu machines. And do this outside of production hours.....

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...