Enable the cluster search head
Before reading this topic, read "Cluster deployment overview".
To search the cluster, you need to enable at least one cluster search head.
Before enabling the search head, you must enable and restart the master node, as described in "Enable the master node".
The procedure in this topic explains how to use Splunk Web to enable a search head. You can also enable a search head in two other ways:
- Directly edit the search head's
server.conffile. See "Configure the search head with server.conf" for details. Some advanced settings, including multi-cluster search, can only be configured by editing this file.
- Use the CLI
edit cluster-configcommand. See "Configure the search head with the CLI" for details.
Important: This topic explains how to enable a search head for a single-site cluster only. If you plan to deploy a multisite cluster, see "Configure multisite clusters with server.conf".
Enable the search head
To enable a Splunk instance as a cluster search head:
1. Click Settings in the upper right corner of Splunk Web.
2. In the Distributed environment group, click Clustering.
3. Select Enable clustering.
4. Select Search head node and click Next.
5. There are a few fields to fill out:
- Master IP address or Hostname. Enter the master's IP address or hostname. For example:
- Master port. Enter the master's management port. For example:
- Security key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all cluster instances. If the master has a security key, you must enter it here.
6. Click Enable search head node.
The message appears, "You must restart Splunk for the search node to become active. You can restart Splunk from Server Controls."
7. Click Go to Server Controls. This takes you to the Settings page where you can initiate the restart.
Now that you've enabled the cluster search head, you can:
- View the search head dashboard
- Allow the search head to search other clusters
- Add search heads to the cluster
- Perform additional configuration on the search head
View the search head dashboard
After the restart, log back into the search head and return to the Clustering page in Splunk Web. This time, you see the search head's clustering dashboard. See "View the search head dashboard" for more information.
Allow the search head to search multiple clusters
From the dashboard, you can add additional clusters for the search head to search. For details, see "Configure multi-cluster search".
Add search heads to a cluster
You can set up multiple search heads to accommodate more simultaneous searches. For information on how to determine your search head needs, see "Hardware capacity planning for a distributed Splunk deployment" in the Distributed Deployment manual.
If you want to set up more search heads for a single cluster, just repeat the enablement procedure for additional instances. If you want to pool the search heads so that they share configuration and user data, see the additional configuration instructions in the topic "Overview of search head pooling" in the Distributed Search manual.
Perform additional configuration
For more information on clustered search head configuration, see "Search head configuration overview".
Enable the peer nodes
Best practice: Forward master node data to the indexer layer
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14