Making search head clustering

[graju89]

Hi,

I need step to step process of adding new search head into my splunk instances. My splunk setup as follows:
1. one search head
2. one deployment server
3. three search peers.

So i am adding another search head that means I have ti create a search head cluster and do the configuration. Can any one help me with the complete step?

Thanks.

[RohitMu]

This cheat sheet is helpful
https://www.aplura.com/wp-content/uploads/2017/08/shc_cheatsheet.pdf

[richgalloway · Accepted solution]

You must have at least three search heads to create a search head cluster (SHC). You will also need a search head deployer, which possibly can be done by your deployment server.

However, just because you have more than one search head does not mean you need a SHC. You can have two independent search heads, but they won't share capacity and will be harder to manage.

If you still want an SHC, Splunk docs explain how to do it at https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/SHCdeploymentoverview.

[graju89]

@richgalloway Hi, I will have only two search head. Don't I need SHC?

[ChrisG]

Not with two search heads, no. Quoting from System requirements and other deployment considerations for search head clusters:

The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

• Three members, so that the cluster can continue to function if one member goes down. See Captain election process has deployment implications.
• The replication factor number of instances. See Choose the replication factor for the search head cluster.

For example, if your replication factor is either 2 or 3, you need at least three instances.

[graju89]

@ChrisG Thank you so much.

[graju89]

@ChrisG @richgalloway I am having trouble in finding the security key when adding the new search head into the cluster. Do you know where I can or how I can get the security key when adding the new search head into clustering.

Thanks,

[sloshburch]

I think you are refering to the pass4SymmKey. Review to Set up the deployer

[ChrisG]

Have you read the docs already? There is extensive information about search head clustering, starting with About search head clustering in the Distributed Search manual. See also Search head clustering architecture and Deploy a search head cluster, among many other topics in that manual.