Deployment Architecture

How to properly replace search heads in a search head cluster?



I have 20+ 8 CPU search heads. Going to be installing 24 CPUs search heads and retiring these old ones that are currently configured in a search head cluster.

Basic plan is to add them to the pool, wait a day, then remove the old ones. Anything in there I am forgetting? Any special tuning to make Splunk realize the new search heads have more cores?

0 Karma

Splunk Employee
Splunk Employee

SHC wont recognize different cores across the cluster. It currently assumes what the captain has, all the other members have. So it's best to pull out all the lower spec machines ASAP.

I'd recommend adding them to the SHC, and make sure that once you have added them, make sure the captain is still the lower CPU count member. Then after you have the all added, remove as many of the old ones as possible, then force a captain on the higher cpu machines. And do this outside of production hours.....

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...