How to properly replace search heads in a search head cluster?

[daniel333]

All,

I have 20+ 8 CPU search heads. Going to be installing 24 CPUs search heads and retiring these old ones that are currently configured in a search head cluster.

Basic plan is to add them to the pool, wait a day, then remove the old ones. Anything in there I am forgetting? Any special tuning to make Splunk realize the new search heads have more cores?

[esix_splunk]

SHC wont recognize different cores across the cluster. It currently assumes what the captain has, all the other members have. So it's best to pull out all the lower spec machines ASAP.

I'd recommend adding them to the SHC, and make sure that once you have added them, make sure the captain is still the lower CPU count member. Then after you have the all added, remove as many of the old ones as possible, then force a captain on the higher cpu machines. And do this outside of production hours.....