Deployment Architecture

Process for adding addtional Indexers + dedicated search head

chrome
New Member

I'm looking for current documentation/process for adding additional indexers and moving to dedicated search head.

Our current setup is a search head + indexer and 2 dedicated indexers.

We would like to add 2 new servers. 1 would be used as a dedicated search head and the other will be a dedicated indexer. So, net result would be 1 dedicated search head and 3 indexers. Also, not sure if I should remove search head from existing server or leave for summary indexes.

These are the documents I've reviewed:
Install dedicated search head
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Installadedicatedsearchhead

Options for migrating search head data..
http://splunk-base.splunk.com/answers/37826/move-a-vm-search-head-to-a-new-physical-server

Migrating index data…
http://splunk-base.splunk.com/answers/6521/expanding-splunk-installation-from-a-single-indexer-to-a-...

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It might be useful to understand http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F if you are moving from a system with indexing and search on a single node to one where the operations (and the corresponding configuration) is on different nodes.

0 Karma
Get Updates on the Splunk Community!

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...