How to isolate the indexer and search head from the same server box and move one of them to a different box?

[pdantuuri0411]

In our small Splunk environment, we have the search head and the indexer on the same server box. Due to performance issues, we are thinking of giving the search head a separate server box.

What steps should be followed in this process? Is there any good documentation for this.

Thank you

[nickhills · Accepted solution]

You want to move to a distributed deployment.

This is actually quite straightforward. You simply use your existing Splunk deployment as the 'Indexer' (or 'Search Peer'), and a new 'Search Head' to it.

Build yourself a new server, download and install (the same version) of Splunk and install it. Then follow the following guide to add your existing 'Search Peer' to your new 'Search Head'
https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/Configuredistributedsearch

Once you have completed that, you can copy your existing Apps to the new SH, test and share the new URL with your users.

[pdantuuri0411]

@nickhillscpl Thank you for the reply.

In that case won't we have 2 search heads? And we don't want our URL to change as it is pretty standard across the organization. Is there a way we can use the old URL?

[nickhills]

Technically yes, but every indexer/cluster master/heavy forwarder is still a SH. The difference is that you just want to stop using it as one.

If you have a nice url like Splunk.mycompany.com hopefully that is a CName for your server?
In which case you can just change the alias when you have finished testing.

If on the other hand, the url is the actual hostname of your Splunk server, now is a good time to break that dependency and introduce a CName as an alias.

Running Splunk via a hostname restricts you in the future as your deployment grows so you are better of changing it sooner.