I'm looking for current documentation/process for adding additional indexers and moving to dedicated search head.
Our current setup is a search head + indexer and 2 dedicated indexers.
We would like to add 2 new servers. 1 would be used as a dedicated search head and the other will be a dedicated indexer. So, net result would be 1 dedicated search head and 3 indexers. Also, not sure if I should remove search head from existing server or leave for summary indexes.
These are the documents I've reviewed:
Install dedicated search head
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Installadedicatedsearchhead
Options for migrating search head data..
http://splunk-base.splunk.com/answers/37826/move-a-vm-search-head-to-a-new-physical-server
Migrating index data…
http://splunk-base.splunk.com/answers/6521/expanding-splunk-installation-from-a-single-indexer-to-a-multi-indexer-dedicated-search-head-environment
... View more