Splunk Search

Add standalone Indexer to Search Head cluster which already have a Indexer cluster

sairam1444
Engager

Hi SPlunkers,

I have a multisite search head cluster TWO SH's
SH1 ( SITE1 ) and SH2 ( SITE2 )

AND

I have multisite indexer cluster - TWO IDX
IDX1 ( SITE1) and IDX2 ( SITE2)

So SH CLUSTER IS PAIRED WITH INDEXER CLUSTER VIA CLUSTER MASTER ---- This is the current setup

Now I have a standalone Indexer which I want to add to this SH CLUSTER

IS it possible?
IF YES, could you please guide me !!

Tags (1)
0 Karma

harsmarvania57
Ultra Champion

Hi,

Have a look at https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Configureclusteredandnonclusteredsearch

Additionally it is not recommended to run SH Cluster with 2 members only, as per Splunk recommendation minimum 3 SH require in Search Head Cluster.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...