I'm trying to take a single node Splunk Enterprise system and expand it to a cluster with an additional search head and indexes. I copied the existing install to a new system and that worked perfectly. Then I added the cluster manager and indexes and all of the settings that were in the old system that were copied to the search head were gone. I'm assuming that I put the copy of the single node into the wrong role, but I'm not sure which role I should have picked. ... View more