All of this has been through the GUI. On the search head I enabled clustering and added it as the Search peer. Is that not the way to do it? ... View more

Steps Taken: 1. Installed Splunk Enterprise on all new servers. 2. Enabled clustering on the designated manager node. 3. Configured clustering on the new indexer, adding it as a peer node. 4. Enabled clustering and added the new server as a search head. After verifying that the newly added servers appeared on the manager node, I attempted to enable clustering on the existing standalone Splunk server and add it as a peer node. However, when I tried to restart the Splunk services, they wouldn't start. I had to remove the clustering stanza for the services to start successfully. I'm unsure where I went wrong or if I missed a step, but it seems that adding the standalone server to the newly created cluster prevents it from starting unless I remove the clustering stanza. ... View more

Hey Giuseppe,   I followed all of your steps for HA configuration. Built a new Search head, master node, and new indexer. I enabled clustering and added the search head and newly built indexer to the cluster. Once i added the once standalone splunk server to the cluster the splunk service wouldnt start. And now if fails when i try starting it. Any idea on why this would be? ... View more

Can i keep my once standalone server now one of my indexers as the deployment server? Or do i need to designate another server as the deployment server? ... View more

Currently working on these steps. I have copied the indexes.conf from the standalone to the master node. Will i need to copy that config file to the new indexer as well? ... View more

Thanks! Do i need to create and designate my cluster manager first and then cluster my indexers? I am trying to figure out what i need to do first after making a new indexer and how i can cluster my two indexers. Also, same with my new search head. I dont know what step to take first?  ... View more

Hey Giuseppe   Thanks for your response this is exactly what i was looking for. Can a virtual machine suffice for an cluster manager? I was wanting to cluster my environment for HA. If I enable clustering do I still need to copy all of my data from the original indexer and copy onto my new indexer? Or if i enable clustering what do i need to do to replicate my data from my original indexer to my new indexer? Another question, if I am deploying a new indexer should I update all my forwarders to send to both indexers or should i leave it to where its sending its data to the original indexer? ... View more

So i just tried to search for the eventtype cisco_ios and its telling me it does not exist or is disabled? Any suggestions on how i get that eventype enabled? ... View more