Splunk Search

Multiple Search Heads in a Cluster

hvandenb
Path Finder

We're setting up an Index Cluster with a Master Node. From the documentation it looks like the Cluster will take care of replicating data and configuration between the Indexers. However, we're also wanting to have multiple search heads that work with the cluster.

What have people used to setup the search heads behind a load balancer. Do we need to use shared storage for the search heads or is there better configuration?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

hvandenb
Path Finder

I remember seeing a press on conf2013 about this as well. Basically, only the knowledge items need to be shared on the search heads.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

@gkanapathy did mention something similar to that in his Architecting for Scale talk at .conf 2012, maybe he can shed some light on viable alternatives to search head pooling.

0 Karma

hvandenb
Path Finder

Thanks for the answer. I'd like to avoid using shared storage as this adds complexity. I heard that some folks rsync knowledge bundles between search heads. We don't plan on running scheduled searches on the search heads, but rather have a separate server for that.
Have you seen this as an option?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...