Configure the search head with server.conf
Prerequisites
Before reading this topic, see Configure the indexer cluster with server.conf. It discusses configuration issues that are common to all cluster node types.
Enable a search head
The following example shows the basic settings that you must configure when enabling a search head node. The configuration attributes shown here correspond to fields on the Enable clustering page of Splunk Web.
[clustering] master_uri = https://10.152.31.202:8089 mode = searchhead pass4SymmKey = whatever
This example specifies that:
- the search head's cluster master resides at
10.152.31.202:8089. - the instance is a cluster search head.
- the security key is "whatever".
Edit the search head settings
You can change these settings later, if necessary. For example, to change the cluster's security key, you change the pass4SymmKey value on each node.
You can also configure the search head to search across multiple indexer clusters or across clustered and non-clustered search peers. See:
| Configure the search head with the dashboard | Configure the search head with the CLI |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!