Splunk Dev

why searchead peering / multi searcheads

aneriz
New Member

Hi, sorry in advanced, im kinda new to splunk.

im wonder, maybe im missing something here
but, why do i need a multi / peering of SH?
as far as i know, SH is a web interface with user/pass authentication.
why not connecting to SH from different clients using the same credentials, that way dashboards and other objects is shared for all users.

thanks!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aneriz,
what's your question?

SH it isn't only a web interface: it's an application tier that contains apps and related access rules.
To have more SHs is useful when users grow.

So you can have SHs clustered or not: if clustered there's replication of the knowledge objects (dashboards, lookups, fields, etc...) and access rules (users, roles) between SHs; if instead you don't have clustered SHs you must manually align SHs.

Bye.
Giuseppe

0 Karma

aneriz
New Member

Hi Giuseppe, thanks for replying back 🙂
sorry if i was missunderstood.
I know whats the SH role, but
based on your answer - *more SHs is useful when users grow*
im asking - why installing more SH instances? it
s just a matter of load balancing?
why cant i use the same instance, give my multiple users the same URL (my only one) ?
they will authenticate with their credentials and that`s it.
hope my question is more clear.
Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...