Deployment Architecture

Does Splunk support two search head clusters with one indexer cluster?

ankithreddy777
Contributor

Does Splunk support two search head clusters with one indexer cluster? Basically we have 3 search heads clustered. we want to add other 3 search heads which should be separately clustered. Is it possible?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster

View solution in original post

lgely
Explorer

Yes ! You can have 2 Search Head Cluster and only one indexer cluster and request same data from each one

SHC 1 : at least 3 SH + Deployer1
SHC 2 : at least 3 SH + Deployer2
=> you need have one deployer by SHC to deploy apps on SHC 1 and other apps on SHC 2

The difference is in server.conf :
same keypass under [clustering] stanza to exchange with master node of your cluster indexer
but
different keypass under [shclustering] stanza to have 2 SHC

example server.conf on one SH of your new SHC
[shclustering]
conf_deploy_fetch_url = https://ip_deployer2:8089
disabled = 0
mgmt_uri = https://ip_new_sh:8089
pass4SymmKey = < NEW keypass between SH/deployer for your new cluster >
shcluster_label = sh_cluster2
id = XXXXXXXXXXXXXXXXXXXXXXXXXXXX

[clustering]
master_uri = https://same_ip_on_each_SH:8089
mode = searchhead
pass4SymmKey = < same keypass you have on your master node >

[general]
serverName = sh01_cluster2
pass4SymmKey = < same keypass you have on your licence server >

[license]
master_uri = https://same_ip_on_each_SHC:8089

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster

niketn
Legend

Splunk Search Head Clustering requires minimum three search heads.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...