Enterprise Security 6.x Multisite Search head Cluster

[danan5]

Hi,

Does anyone happen to know if Multisite search head clustering is suppported in ES 6.x? The validated architectures document says not, but it was written in 2018. Reading the release notes of 6.0, 6.0.1 and 6.1 it sounds like there have been ajustments to the way it handles SHC knowledge objects but I don't know if this changes the advice from the validated design docs.

"a single dedicated search head cluster contained within a siteis required to deploy the app . ES requires a consistent set of runtime artifacts to be available and this cannot be guaranteed in a stretched SHC when a site outage occurs. To be able to recover an ES SH environment from a site failure, 3rd party technology can be used to perform a failover ofthe search head instances, or a "warm standby" ES SH can be provisioned and kept in synch with the primary ES environment.

Regards,
David

[nickhills]

ES can be run on a single site SHC but it is notoriously difficult to a.) get working properly b.) keep working. (Let alone MultiSite)

If you are determined to run ES on SHC you would be highly advised to engage Splunk Professional Services.
They will probably tell you the same thing, but will happily take your money 🙂

There are compelling reasons why you might want to run ES on SHC, and some companies have had great success with it, but this is one to seek some expert on site help with.