Is there a way to take the existing stand-alone search head and turn it into a single member SHCluster?

[PM4371]

Currently have a single stand-alone search head.  We did NOT install it as a single-member SHCluster.  At the time I didn't know that could be done.  We have 2 more servers coming so that we can create a 3 member search head cluster.  I've been through a ton of docs but can't figure out the best way to accomplish this task. 

Is there a way to take the existing stand-alone search head and turn it into a single member SHCluster? 

So that I can easily then add the other 2 servers into the cluster? 

I can't find a doc for that.  Or do I have to take 1 or the 2 new servers set it up as a single member cluster, then migrate all the app and settings from the existing stand alone search head  to the new single member cluster server and then add the other 2 servers?

Appreciate in any insight anyone can give me.

Thanks

[gcusello]

Hi @PM4371,

as @richgalloway said, you cannot craete a single member SHC and then add the other two members.

You can create a SHC following the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/SHCsystemrequirements

Anyway, following the above instructions, you can create your SHC.

Before to do this, you could save on the Deployer on the existing SH the apps you want to preserve and then deploy them to all the members, but you cannot add an already configured SH to a cluster.

Ciao.

Giuseppe

[richgalloway]

You can't convert a SH into a SHC member.  SHC members must be brand-new Splunk instances.  That's why you can't find a doc for it.  🙂

[VatsalJagani]

Yeah, also when you convert it to an SHC member, it will lose all its configuration anyway and becomes brand new. That's why you will require a brand new member.

The recommendation is that you reinstall Splunk on the instance and then use it as an SHC member.