We have a single SearchHead Node which works over a Indexer Cluster.
All Configurations like users, roles, Dashboards etc are present on this Node.
We are now looking to create a SearchHeadcluster...
...low, I am preparing for the future.
We can pump up the specs on theSearchHead, or create a new SearchHead. How do I decide which will work best? Another SH seems like it might add complexity, b...
I am adding a new searchheadtothe existing searchheadcluster. I want toaddthe same userstothe new searchhead, from my LDAP. If I copy the authorize.conf & authorization.conf, will it a...
...: am i able to use 3 searchhead nodes that are already pointing thethe back-end index cluster and then just run the commands toaddthese members tothesearchheadcluster (and elect a captain) &l...
I wish to uninstall an app from my SearchHeadcluster and cluster peers. Is this the following the way to go about it?
On each SearchHead and peer cluster member:
1.Run the following c...
...uggestions?
EDIT: I forgot to mention that if I manually go to each searchhead and addthe appOrder parameter tothe standard user-prefs app, then it works. I just would like to do it centrally from the d...
I would like to enable tosearch assistant on my SearchHeadCluster. The documentation recommends an edit tothe file user-prefs.conf.spec.in. (Is this a bad idea?)
Described here:
https://d...
I've been setting up the Splunk for Windows Infrastructure app on my searchheadcluster. In the instructions it says toaddthe winfra-admin role to a user. In authorize.conf in $SPLUNK_HOME/etc/s...
...ttempt tosearch using both the strong and weak searchhead and slow me down?
What it comes down to is that I do not need the full "cluster", I just need to keep my user data replicated. It seems t...
...r notable event data to a 3rd party app when a saved search is matched. Our Add-on ships 2 saved searches for usersto use to verify that theadd-on is configured properly with the 3rd party app. On s...