Deployment Architecture

Is there an order of installation when building Splunk indexer and search head clusters?


Is there a order of installation when building a Splunk Cluster?

I have detailed links and documents about the specific items, but it's difficult to determine the order of configuration & installation.
I'm using as a reference.

Splunk cluster deployment order:
1. indexer cluster - master
2. indexer cluster - peers
3. search head cluster - Deployer
4. search head cluster - Members
5. search head cluster - Captain
6. integrate search cluster into indexer cluster
7. connect search heads to search peers

Thank you! -Sean


I think the order will be
1) Indexer Master
2) Peer Nodes (Indexer)
3) Search Peer Nodes with Indexer Clusterring Enabled and pointing to Master Node
4) Search Head Deployer
5) Enable Search Head Clustering on each Search head Peer
6) Choose Search Head Captain

You may also add a Deployment Server for pushing configurations on UF /HF.

0 Karma

Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...