Splunk Enterprise Security

Multple Enterprise Security clusters to one search peer pool


Is it possible to have two instances of ES searching the same search peer pool?

0 Karma

Splunk Employee
Splunk Employee

It's 'possible' to install two, but I would not recommend doing so. The impact of running two ES Search Heads can have a catastrophic effect on the peers as you're running double the data model accelerations, plus all the other scheduled searches ES runs in the background.

If you want to set up a second ES node for testing (or similar) purposes, it's best to place it on a separate environment.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...