Integrate the search head cluster with an indexer cluster
To integrate a search head cluster with an indexer cluster, you must configure each member of the search head cluster as a search head on the indexer cluster. Once you have done that, the search heads will get their list of search peers from the master node of the indexer cluster.
In this diagram, a search head cluster performs searches across a single-site indexer cluster:
Integrate with an indexer cluster
Configure each search head cluster member as a search head on the indexer cluster. Use the CLI
splunk edit cluster-config command. For example:
splunk edit cluster-config -mode searchhead -master_uri https://10.152.31.202:8089 -secret newsecret123 splunk restart
This example specifies:
- The instance is a search head in an indexer cluster.
- The master node of the indexer cluster resides at
- The security key is "newsecret123". You must use the same security key across all nodes in both the indexer cluster and the search head cluster.
You must do this for each member of the search head cluster.
This is all you need for the basic configuration. The search heads now run their searches against the peer nodes in the indexer cluster.
For more information
For more information on configuration of search heads on indexer clusters, see the chapter "Configure the search head" in the Managing Indexers and Clusters of Indexers manual. That chapter also includes configuration for more complex scenarios, such as hybrid searching, where the search heads search across both indexer clusters and non-clustered indexers.
Deploy a search head cluster
Connect the search heads in clusters to search peers
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15