Single search head and single indexer

[timsheets13]

I have seen in other threads that this questions has been asked before but I can't seem to find an answer.  I have a single "all in one" instance.  I have built another Splunk server and would like it to be a dedicated search head and leave the original as a dedicated indexer.

Is there a way to set this up without clustering?  Obviously, no cluster is needed with one of each Splunk server role.

THanks

[gcusello]

Hi @timsheets13,

you have to see in [Settings -- Distributed Search] and configure the new machine as a Search Head, setting the old machine as a Search peer.

Cluster is another thing non applicable to your architecture.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.2.0/DistSearch/Whatisdistributedsearch

Ciao.

Giuseppe