Splunk Search

How to add search peers in a search head cluster?

daniel333
Builder

Is there a trick to adding search peers with a search head cluster? I have to add 20 new indexers very soon and I don't want to have to goto each SH GUI over and over. Assuming there is a script somewhere I should be running?

0 Karma

lguinn2
Legend

You could do this:

  1. Create a new app on the deployer. In the local directory of the app, create a file names distsearch.conf
  2. In distsearch.conf, list all the search peers (including the existing ones)
  3. Use the deployer to distribute the app to the search heads.

Here is some info on creating/editing distsearch.conf

jplumsdaine22
Influencer

(facepalm) I wish they put that in the documentation 🙂

0 Karma

daniel333
Builder

Hey yes, the manual key exchange is what I am trying to avoid. Assuming there is a script or something that we should be using?

Distribute the key files
If you add search peers via Splunk Web or the CLI, Splunk Enterprise automatically configures authentication. However, if you add peers by editing distsearch.conf, you must distribute the key files manually. After adding the search peers and restarting the search head, as described above:

  1. Copy the file $SPLUNK_HOME/etc/auth/distServerKeys/trusted.pem from the search head to $SPLUNK_HOME/etc/auth/distServerKeys//trusted.pem on each search peer.

The is the search head's serverName, specified in server.conf.

  1. Restart each search peer.
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...