What are the best practices for setup and using a search head server to take the load off of our indexer?
We have an enterprise license. Do you have a how-to somewhere for adding another search head
and how is the licensing being added to the enterprise license?
Hi kairobin,
take a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Overviewofconfiguration to get more details how it can be done.
Regarding the license; you can configure the search head as license slave http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Configurealicenseslave , but usually the search head will not consume any license volume since it will not index any data.
Hope this helps ...
cheers, MuS