Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Table of Contents (20 chapters)
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Multiple search heads


Using the search head pooling feature, it is possible to run multiple search head instances. The feature requires a share of some sort behind the servers acting as search heads, which effectively means they must be in the same data center. The setup looks essentially like the following figure:

In short, the steps to configure the search are as follows:

  1. Mount the NFS volume on each search head.

  2. Enable the pooling feature on each instance.

  3. Copy the existing configurations to the NFS volume.

  4. Test the search heads.

  5. Enable the load balancer.

The official documentation is available at http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling.