Splunk Search

Deploy search head cluster

siemteam
Explorer

Hello,

I'm deploying a search head cluster and I have a doubt about the steps described on the following link:

https://docs.splunk.com/Documentation/Splunk/7.2.1/DistSearch/SHCdeploymentoverview

I understand that server.conf file is the file that you can find on /opt/splunk/etc/system/default folder, it's ok?

On this file I can see too the configuration line "disabled=true" but documentation don't specify as necesary modify this flag, it's ok or should I change to false?

Thanks

Tags (1)
0 Karma

dkeck
Influencer

HI,

you do not want to change server.conf in /opt/splunk/etc/system/default. If you want to change config in server.conf than create a new server.conf in /opt/splunk/etc/system/local and change only the stanzas that are neccessary. Do not copy the whole default/sever.conf content.

Kind Regards

0 Karma

siemteam
Explorer

Thanks for your answer.

And what about "dissabled=true"?

0 Karma

dkeck
Influencer

just follow the steps in the manual that you liked and you should be fine

Depends where in server.conf this was set, but if it was set in default server.conf could have its right to be there, If the manual it not teling you to change this, then dont.

0 Karma

dkeck
Influencer

Did this work for you ?

if it helped please accept the question 🙂

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...