How to add a search head to search against our Splunk indexer?

[kairobin]

What are the best practices for setup and using a search head server to take the load off of our indexer?
We have an enterprise license. Do you have a how-to somewhere for adding another search head
and how is the licensing being added to the enterprise license?

[MuS]

Hi kairobin,

take a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Overviewofconfiguration to get more details how it can be done.
Regarding the license; you can configure the search head as license slave http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Configurealicenseslave , but usually the search head will not consume any license volume since it will not index any data.

Hope this helps ...

cheers, MuS