O'Reilly logo

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence by Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Multiple search heads

Using the search head pooling feature, it is possible to run multiple search head instances. The feature requires a share of some sort behind the servers acting as search heads, which effectively means they must be in the same data center. The setup looks essentially like the following figure:

Multiple search heads

In short, the steps to configure the search are as follows:

  1. Mount the NFS volume on each search head.
  2. Enable the pooling feature on each instance.
  3. Copy the existing configurations to the NFS volume.
  4. Test the search heads.
  5. Enable the load balancer.

The official documentation is available at http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configuresearchheadpooling ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required