Splunk 7.x Quick Start Guide

Search head clusters

A search head cluster is a group of Splunk Enterprise search heads that share configurations, search job scheduling, and search artifacts, which are the results and associated metadata from a completed search job. You will want to utilize a search head cluster in a distributed Splunk deployment to handle more users and concurrent searches, and to provide multiple search heads so that search capability is not lost if one or more search members goes down. There are a few design-related factors about search head clusters you need to be aware of while architecting and especially administering your Splunk solution, which we'll cover here.

In a search head cluster, one of the members has the role of captain, whose duties include, ...