About search head clustering

A search head cluster is a group of Splunk Enterprise search heads that serves as a central resource for searching. The members of a search head cluster are essentially interchangeable. You can run the same searches, view the same dashboards, and access the same search results from any member of the cluster.

To achieve this interchangeability, the search heads in the cluster must share configurations and apps, search artifacts, and job scheduling. Search head clusters automatically propagate most of these shared resources among the members.

Benefits of a search head cluster

Search head clusters provide these key benefits:

• Horizontal scaling. As the number of users and the search load increases, you can add new search heads to the cluster. By combining a search head cluster with a third-party load balancer placed between users and the cluster, the topology can be transparent to the users.
• High availability. If a search head goes down, you can run the same set of searches and access the same set of search results from any other search head in the cluster.
• No single point of failure. The search head cluster uses a dynamic captain to manage the cluster. If the captain goes down, another member automatically takes over management of the cluster.

Cluster architecture

A search head cluster consists of a group of networked search heads, called cluster members. One cluster member, the captain, coordinates all cluster-wide activities. If the member serving as captain goes down, another member takes its place.

The members share:

• Job scheduling. The cluster manages job scheduling centrally, allocating each scheduled search to the optimal member, usually the member with the least load.
• Search artifacts. The cluster replicates search artifacts and makes them available to all members.
• Configurations. The cluster requires that all members share the same set of configurations. For runtime updates to knowledge objects, such as updates to dashboards or reports, the cluster replicates configurations automatically to all members. For apps and some other configurations, the user must push configurations to the cluster members by means of the deployer, a Splunk Enterprise instance that resides outside the cluster.

See "Search head clustering architecture."

How to set up the cluster

You set up a cluster by configuring and deploying the cluster's search heads. The process is similar to how you set up search heads in any distributed search environment. The main difference is that you also need to configure the search heads as cluster members.

See the chapter "Deploy search head clustering".

How the user accesses the cluster

Users access the cluster the same way that they access any search head. They point their browser at any search head that is a member of the cluster. Because cluster members share jobs, search artifacts, and configurations, it does not matter which search head a user accesses. The user has access to the same set of dashboards, searches, and so on.

To achieve the goals of high availability and load balancing, Splunk recommends that you put a load balancer in front of the cluster. That way, the load balancer can assign the user to any search head in the cluster and balance the user load across the cluster members. If one search head goes down, the load balancer can reassign the user to any remaining search head.

Search head clusters and indexer clusters

Search head clusters are different from indexer clusters. The primary purpose of indexer clusters is to provide highly available data through coordinated groups of indexers. Indexer clusters always include one or more associated search heads to access the data on the indexers. These search heads might be, but are not necessarily, members of a search head cluster.

For information on search heads in indexer clusters, see the chapter "Configure the search head" in the Managing Indexers and Clusters of Indexers manual.

For information on adding a search head cluster to an indexer cluster, see the topic "Integrate the search head cluster with an indexer cluster" in this manual.