Deployment Architecture

Does Splunk support two search head clusters with one indexer cluster?

ankithreddy777
Contributor

Does Splunk support two search head clusters with one indexer cluster? Basically we have 3 search heads clustered. we want to add other 3 search heads which should be separately clustered. Is it possible?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster

View solution in original post

lgely
Explorer

Yes ! You can have 2 Search Head Cluster and only one indexer cluster and request same data from each one

SHC 1 : at least 3 SH + Deployer1
SHC 2 : at least 3 SH + Deployer2
=> you need have one deployer by SHC to deploy apps on SHC 1 and other apps on SHC 2

The difference is in server.conf :
same keypass under [clustering] stanza to exchange with master node of your cluster indexer
but
different keypass under [shclustering] stanza to have 2 SHC

example server.conf on one SH of your new SHC
[shclustering]
conf_deploy_fetch_url = https://ip_deployer2:8089
disabled = 0
mgmt_uri = https://ip_new_sh:8089
pass4SymmKey = < NEW keypass between SH/deployer for your new cluster >
shcluster_label = sh_cluster2
id = XXXXXXXXXXXXXXXXXXXXXXXXXXXX

[clustering]
master_uri = https://same_ip_on_each_SH:8089
mode = searchhead
pass4SymmKey = < same keypass you have on your master node >

[general]
serverName = sh01_cluster2
pass4SymmKey = < same keypass you have on your licence server >

[license]
master_uri = https://same_ip_on_each_SHC:8089

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster

niketn
Legend

Splunk Search Head Clustering requires minimum three search heads.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...