Deployment Architecture

Splunk enterprise standalone search head to point another splunk enterprise standalone indexer



We want to add Q server to our development activities, where we used to have only one server earlier,  which is enterprise standalone splunk instance, to be little precise i name it as 'A' which is also the production one. Now we have to maintain P and Q server separately for production and testing.

Current splunk enterprise instance  'A'  is a standalone and we continue with the production activities on it. But. to have Q server live. we have to move the Apps and data (A/Production server) in index to Q server for testing.

Before migrating, i was trying to point splunk enterprise Q server's(B instance) search head to splunk enterprise P server's(A instance) indexer. As this could make our Q server availability in a faster way.

Enterprise standalone splunk Q(B) search head -> Enterprise standalone  splunk P(A) indexer

It could be great, if i was guided to configure the above one or any directions in terms of distributed or indexer clustering,or adding peers.

Advance thanks.

Labels (4)
0 Karma


If I read your post correctly, I think you would need to implement multi-site clustering to achieve your goal.

See the following documentation to configure a search head (or SHC) across two or more sites:


An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...