Types of Splunk Deployments
Index Clustering - Tons of info/links that branch into more info all over this page
Things I wish I knew then - This has some useful all around info
Decide on FIPS before starting the upgrade/migration
The toughest part for me was when I upgraded to an indexer cluster, I wasn't able to bring over the indexed data from the stand alone. There is a complex option of renaming bucket GUIDs to match the new GUIDs structure but I didn't go that route. I was able to search the standalone from the new SH but once I turned off the old Splunk I lost the data. Oh and create a deployment plan filling in all of your decision points and formula/values/IPs/IndexNames/Forwarders/etc, pass4symkey and other items .. this was invaluable.
Good Luck!
... View more