We will be using rsync to keep our 2 enterprise search heads in sync. I found a Splunk wiki page on this topic but it is for an older version (3.3) of Splunk. We are using Splunk 6.4. Is there a newer wiki or another documented resource on what to keep in sync between the 2 search heads?
Why are you not using the 2 supported options?
Search Head clustering:
we can't head SH clustering as we only have 2 search heads, and I read somewhere search head pooling was deprecated... I will check out your links.. thank you!
As Splunk says:
This feature has been deprecated as of Splunk Enterprise version 6.2. This means that although it continues to function, it might be removed in a future version.
deprecated does not mean
Starting with 4.2, you can use search head pooling to share configurations and user data between search heads. So, the Search Head Pooling with LDAP authentication, you do not need to rsync the apps, users, and dispatch jobs among search heads, anymore.
Note: Search head pooling has been deprecated in Splunk Enterprise version 6.2.
Search Head Cluster takes care of this one.
Barely. SHP has a lot of performance problems in most cases, as it is CIFS/NFS based. Rsync provides different levels of pain. From what I have seen in the past, attempting to sync search heads via rsync produces weirdness (at best). Best option here, unfortunately, is to get another search head. Splunk recommends that servers in SHC be similar, which makes sense, as SHC doesn't really have a concept of "weighting". However, perhaps a small VM that sees no end-user searches.