I have seen in other threads that this questions has been asked before but I can't seem to find an answer. I have a single "all in one" instance. I have built another Splunk server and would like it to be a dedicated search head and leave the original as a dedicated indexer.
Is there a way to set this up without clustering? Obviously, no cluster is needed with one of each Splunk server role.
THanks
Hi @timsheets13,
you have to see in [Settings -- Distributed Search] and configure the new machine as a Search Head, setting the old machine as a Search peer.
Cluster is another thing non applicable to your architecture.
You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.2.0/DistSearch/Whatisdistributedsearch
Ciao.
Giuseppe