I have 4 indexers and one search head.
Is there documentation on how to get SOS on the search head working from all 4 indexers?
Yes, see here:
http://splunk-base.splunk.com/answers/38091/best-practices-to-deploy-the-splunk-on-splunk-app-in-a-d...
View solution in original post