Does Splunk support two search head clusters with one indexer cluster? Basically we have 3 search heads clustered. we want to add other 3 search heads which should be separately clustered. Is it possible?
Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster
Yes ! You can have 2 Search Head Cluster and only one indexer cluster and request same data from each one
SHC 1 : at least 3 SH + Deployer1
SHC 2 : at least 3 SH + Deployer2
=> you need have one deployer by SHC to deploy apps on SHC 1 and other apps on SHC 2
The difference is in server.conf :
same keypass under [clustering] stanza to exchange with master node of your cluster indexer
but
different keypass under [shclustering] stanza to have 2 SHC
example server.conf on one SH of your new SHC
[shclustering]
conf_deploy_fetch_url = https://ip_deployer2:8089
disabled = 0
mgmt_uri = https://ip_new_sh:8089
pass4SymmKey = < NEW keypass between SH/deployer for your new cluster >
shcluster_label = sh_cluster2
id = XXXXXXXXXXXXXXXXXXXXXXXXXXXX
[clustering]
master_uri = https://same_ip_on_each_SH:8089
mode = searchhead
pass4SymmKey = < same keypass you have on your master node >
[general]
serverName = sh01_cluster2
pass4SymmKey = < same keypass you have on your licence server >
[license]
master_uri = https://same_ip_on_each_SHC:8089
Yes you can. One indexer cluster can be searched by multiple search head clusters and vice versa. You need to do following steps on each member of both SHC.
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCandindexercluster
Splunk Search Head Clustering requires minimum three search heads.