Hi Splunk experts!
We have a Splunk Enterprise Search Head Cluster with 3 Search Heads.
We need more cores, so we're adding a 4th physical server.
Is there anything special we need to do besides give it the same config as the other Search Heads? This is the first time since we built the Search Head Cluster that we have added an additional Search Head into it.
Thanks!
See this topic on exactly that issue: http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Addaclustermember