Installation

Add a standalone search head

jwilliams
Explorer

Hello,

  I have a single splunk indexer.   How do I add a search head?   I do not have an index cluster.  At this time I have a single indexer but may go to two indexers.   Documentation talks about index cluster which I do not have.

  My simple goal was to have a search head and a indexer or two indexers.

  This is a new user type question running version 8.

Thanks in Advance,

Jim

Tags (1)
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Configuredistributedsearch

Probably the easiest way to do this is via the Search Head's WebGUI. Log in as an admin, and go to Settings > Distributed Search. Then click on Search Peers. Provide your indexer's IP or FQDN, https://indexer_address:8089 and admin credentials for the indexer. Click Save, and you will have linked the search head with the indexer.

You can also use CLI or .conf files to do so, but I think the WebGUI illustrates it best.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...