What is a search head?

[Alan_Bradley]

I see lots of reference to search heads as a way to improve search performance. I can't find a search head section of the docs? What do I need to do to make a search head? Can I have a hydra splunk with multiple search heads to have even greater efficiency? What do I need to do make this happen

[the_wolverine]

The following Splunk doc provides more detail.

[gkanapathy · Accepted solution]

Search head is simply a Splunk instance that distributes searches to other indexers, and usually doesn't have any indexes of its own. It's set up the same as any other distributed searcher, but because it has no local indexes, all results come from remote nodes. Multiple search heads can be configured, but the indexers that store the data still have to perform significant work for each search, so there is a limit to how much they can help.