Splunk Search

What is a search head?

Alan_Bradley
Path Finder

I see lots of reference to search heads as a way to improve search performance. I can't find a search head section of the docs? What do I need to do to make a search head? Can I have a hydra splunk with multiple search heads to have even greater efficiency? What do I need to do make this happen

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Search head is simply a Splunk instance that distributes searches to other indexers, and usually doesn't have any indexes of its own. It's set up the same as any other distributed searcher, but because it has no local indexes, all results come from remote nodes. Multiple search heads can be configured, but the indexers that store the data still have to perform significant work for each search, so there is a limit to how much they can help.

View solution in original post

the_wolverine
Champion

The following Splunk doc provides more detail.

gkanapathy
Splunk Employee
Splunk Employee

Search head is simply a Splunk instance that distributes searches to other indexers, and usually doesn't have any indexes of its own. It's set up the same as any other distributed searcher, but because it has no local indexes, all results come from remote nodes. Multiple search heads can be configured, but the indexers that store the data still have to perform significant work for each search, so there is a limit to how much they can help.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...