Deployment Architecture

How to properly replace search heads in a search head cluster?

daniel333
Builder

All,

I have 20+ 8 CPU search heads. Going to be installing 24 CPUs search heads and retiring these old ones that are currently configured in a search head cluster.

Basic plan is to add them to the pool, wait a day, then remove the old ones. Anything in there I am forgetting? Any special tuning to make Splunk realize the new search heads have more cores?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

SHC wont recognize different cores across the cluster. It currently assumes what the captain has, all the other members have. So it's best to pull out all the lower spec machines ASAP.

I'd recommend adding them to the SHC, and make sure that once you have added them, make sure the captain is still the lower CPU count member. Then after you have the all added, remove as many of the old ones as possible, then force a captain on the higher cpu machines. And do this outside of production hours.....

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...