I am setting up search head pooling in a geographically diverse implementation. I have indexes and search heads in 3 different cities. All the Splunk units have access to each other over high speed links.
I want to pool the search heads for HA and load management, but do not have a way to give them shared storage. It is not that difficult to make storage at one site available to the others, but if that storage is unavailable, then our search head HA is busted.
I really need search head pooling without the use of shared storage. Could the search heads share info directly with each other instead of writing to shared storage?
What other ways are there to enable search head pooling?
