We're in the process of doing a major upgrade to our Splunk environment. We're effectively moving from a single instance of Splunk doing everything to a "future-proof" setup with multiple indexers, multiple search heads and a separate deployment server.
I'd like to understand what best practice is for how dashboards and alerts should be set up in such an environment.
Thanks for any advice!
Search head clustering (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/AboutSHC) was introduced in Splunk Enterprise 6.2, released on October 28, 2014. A search head cluster captain (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCarchitecture#Search_head_cluster_ca...) coordinates activities among all cluster members. The responsibilities/activities include:
Also see:
Migrate from a standalone search head to a search head cluster
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Migratefromstandalonesearchheads
Use the deployer to distribute apps and configuration updates
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges
How do you set app permissions in a search head cluster
http://answers.splunk.com/answers/225426/how-do-you-set-app-permissions-in-a-search-head-cl.html
I have the same question and would appreciate any input on the topic.
also, how to manage user settings in fore-mentioned environment when users access different search head and view the same dashboard ?