Additional Search Head for Splunk

[anandhalagaras1]

Hi Team,

Currently we are using Splunk Cloud in our organization. i.e. We have a dedicated Search head for ES and another Adhoc search head for rest of the applications.

So we need an additional search head for development and testing purpose.  i.e. All the index logs should  be visible and searchable in the additional search head So do we need to contact Splunk Support on this  to host the same in Cloud and also we want to know will there be any cost involved as well.

Or else do we have any option something like that we can build a new server in Azure and install the Splunk  package into it (Additional Search Head) and can we integrate with Splunk Cloud so that all the index logs should be searchable & visible. So that before going directly into production we will perform a testing in the development environment.

We want a solution that should be cost effective since we majorly use it for development purpose.

Kindly help to address on my query.

[thambisetty]

I have Splunk cloud deployment in AWS and it's completely managed by Splunk cloud support.  I have never come across this problem ( this seems to be design & architecting problem). I hope definitely Splunk cloud supports to have one more instance in cloud, but I doubt if they allow you to connect to Splunk cloud indexers from your own Splunk Enterprise.

But, I would highly recommend you to create a Splunk support case. 

[thambisetty]

Hope you have Splunk cloud support. I advise you to open a case with Splunk support. They will be able to give you quotation for that. 

[anandhalagaras1]

@thambisetty ,

Thank you for your response. But by any chance can we deploy a search head in on-prem (Azure) and integrate with Splunk Cloud?

Do you have any thoughts on it.