Splunk Enterprise

Can anyone explain what are the below searchhead, in perspective of installing an app?

Vipin_Pavithran
Explorer

Hi All,

I'm totally new to Splunk.

Please let know if any can explain what are the below searchhead, in perspective of installing an app. 

1- AdHocSH
2-Premium SH
3-SH Cluster
4-IDM

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

1 - An adhoc SH is a "normal" search head.  It's called that because it's where users go to run interactive ("ad-hoc") searches.

2 - A Premium SH is a search head that runs a premium (extra fee) app such as Enterprise Security or ITSI.

3 - An SH Cluster is a cooperating collection of search heads.  Members of an SHC keep knowledge objects in sync and share resources.   A scheduled search may run on any member of the cluster.

4 - An IDM is a Splunk Cloud instance and not used in other environments.  The Input Data Manager was created as a way to run inputs in Splunk Cloud outside a search head.  This is before Splunk introduced the Victoria experience, which allows inputs on SHs and does not have an IDM.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Vipin_Pavithran
Explorer

Thanks a lot for your response 🙂 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

1 - An adhoc SH is a "normal" search head.  It's called that because it's where users go to run interactive ("ad-hoc") searches.

2 - A Premium SH is a search head that runs a premium (extra fee) app such as Enterprise Security or ITSI.

3 - An SH Cluster is a cooperating collection of search heads.  Members of an SHC keep knowledge objects in sync and share resources.   A scheduled search may run on any member of the cluster.

4 - An IDM is a Splunk Cloud instance and not used in other environments.  The Input Data Manager was created as a way to run inputs in Splunk Cloud outside a search head.  This is before Splunk introduced the Victoria experience, which allows inputs on SHs and does not have an IDM.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...