what is the solution for DR where ES app is in Sh cluster?
Hi @vinayakwagh,
I'm guessing you already know the difference between DR and HA for asking this question.
If you are looking for a DR solution for ES and you're already in stand-alone mode, then a backup of Splunk configuration including ES apps, ad-ons and the kv-store are enough. No need to setup a SH-Cluster, it will only complicate things.
If you're actually looking for HA, then SH clustering could be the solution for you, have a look here for the list of benefits of an SH-cluster:
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/AboutSHC#Benefits_of_a_search_head_clu...
Cheers,
David