Adding another peer to SH to be used for Enterprise Security

[FPERVIL]

I have an existing search head that is peered to 2 cluster mgrs. This SH has the ES app on it. I am looking to add additional data from a remote indexers. Do i just need to add the remote cluster mgr as a peer to my existing SH so that i can access the data in ES?

[PickleRick]

There are two sides to this coin.

1) Yes, if you add another cluster or a standalone indexer your search will be distributed there as well (unless you explicitly limit your search)

2) ES will only work seamlessly if the data in your new indexers matches the already existing configuration. So if you just connect indexers containing more of the same stuff you already have you should be good to go. But if you've been only processing - for example - network data so far but add indexers containing endpoint events you might need to adjust your ES configurations, datamodel accelerations and so on.

[isoutamo]

That’s an excellent point. Actually you must do it or at least check if this is needed every time when you add a new data source. It not matter is it a new source system for indexing to current indexers or a totally new indexer or cluster to your SH.

[isoutamo]

It goes exactly this way. If those are individual indexers then add those one by one a new search peer in SH. If those creates a new cluster then as 3rd CM into your SH.