Getting Data In

How to add a search head to search against our Splunk indexer?

kairobin
Path Finder

What are the best practices for setup and using a search head server to take the load off of our indexer?
We have an enterprise license. Do you have a how-to somewhere for adding another search head
and how is the licensing being added to the enterprise license?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kairobin,

take a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Overviewofconfiguration to get more details how it can be done.
Regarding the license; you can configure the search head as license slave http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Configurealicenseslave , but usually the search head will not consume any license volume since it will not index any data.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...