Thank you @PickleRick for your quick answer. So in this case i will keep the all-in-one as indexer and use the new instance as search head (SHnew).  now i have another small question: besides the all-in-one instance, i need to search data from another splunk deployment (2 indexers), and i already have a search head (SHold) in that other deployment (i know, you will say why not use the existing one! lets say i have to 😅).  the question is, can I simply add the 2 indexers as search peers in the new search head (SHnew) or should i create a search head cluster using the SHold and SHnew (i also have a deployment server that manages the SHold)? thanks for your help and your patience 🙏  ... View more