Deployment Architecture

Search Head Pooling - Shared Storage Not Available

Edub
Explorer

I am setting up search head pooling in a geographically diverse implementation. I have indexes and search heads in 3 different cities. All the Splunk units have access to each other over high speed links.

I want to pool the search heads for HA and load management, but do not have a way to give them shared storage. It is not that difficult to make storage at one site available to the others, but if that storage is unavailable, then our search head HA is busted.

I really need search head pooling without the use of shared storage. Could the search heads share info directly with each other instead of writing to shared storage?

What other ways are there to enable search head pooling?


Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

In 4.2, search head pooling requires shared storage to work.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In 4.2, search head pooling requires shared storage to work.

Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...