Deployment Architecture

Process for adding addtional Indexers + dedicated search head

New Member

I'm looking for current documentation/process for adding additional indexers and moving to dedicated search head.

Our current setup is a search head + indexer and 2 dedicated indexers.

We would like to add 2 new servers. 1 would be used as a dedicated search head and the other will be a dedicated indexer. So, net result would be 1 dedicated search head and 3 indexers. Also, not sure if I should remove search head from existing server or leave for summary indexes.

These are the documents I've reviewed:
Install dedicated search head

Options for migrating search head data..

Migrating index data…

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

It might be useful to understand if you are moving from a system with indexing and search on a single node to one where the operations (and the corresponding configuration) is on different nodes.

0 Karma