Multiple search heads
Using the search head pooling feature, it is possible to run multiple search head instances. The feature requires a share of some sort behind the servers acting as search heads, which effectively means they must be in the same data center. The setup looks essentially like the following figure:
In short, the steps to configure the search are as follows:
- Mount the NFS volume on each search head.
- Enable the pooling feature on each instance.
- Copy the existing configurations to the NFS volume.
- Test the search heads.
- Enable the load balancer.
The official documentation is available at http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling ...
Get Implementing Splunk - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.