Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Enable the search head

Before reading this topic, read "Indexer cluster deployment overview".

To search the cluster, you need to enable at least one search head in the indexer cluster.

Before enabling the search head, you must enable and restart the master node, as described in "Enable the master node".

The procedure in this topic explains how to use Splunk Web to enable a search head. You can also enable a search head in two other ways:

Important: This topic explains how to enable an individual search head for a single-site cluster only:

Enable the search head

To enable a Splunk instance as a search head in an indexer cluster:

1. Click Settings in the upper right corner of Splunk Web.

2. In the Distributed environment group, click Indexer clustering.

3. Select Enable clustering.

4. Select Search head node and click Next.

5. There are a few fields to fill out:

  • Master URI. Enter the master's URI, including its management port. For example: https://10.152.31.202:8089.
  • Security key. This is the key that authenticates communication between the master and the peers and search heads. The key must be the same across all cluster nodes. Set the same value here that you previously set on the master node.


6. Click Enable search head node.

The message appears, "You must restart Splunk for the search node to become active. You can restart Splunk from Server Controls."

7. Click Go to Server Controls. This takes you to the Settings page where you can initiate the restart.

Next steps

Now that you have enabled the search head, you can:

  • View the search head dashboard
  • Allow the search head to search other clusters
  • Add search heads to the cluster
  • Perform additional configuration on the search head

View the search head dashboard

After the restart, log back into the search head and return to the Clustering page in Splunk Web. This time, you see the search head's clustering dashboard. See "View the search head dashboard" for more information.

Allow the search head to search multiple clusters

From the dashboard, you can add additional clusters for the search head to search. For details, see "Search across multiple indexer clusters".

Add search heads to an indexer cluster

You can set up multiple search heads to accommodate more simultaneous searches. For information on how to determine your search head needs, see "Hardware capacity planning" in the Capacity Planning manual.

If you want to set up more search heads for an indexer cluster, just repeat the enablement procedure for additional instances. If you want to deploy a search head cluster, so that the search heads share configurations and jobs, see the additional configuration instructions in the topic "Integrate the search head cluster with an indexer cluster" in the Distributed Search manual.

Perform additional configuration

For more information on configuration of search heads in an indexer cluster, see "Search head configuration overview".

Last modified on 21 September, 2020
PREVIOUS
Enable the peer nodes
  NEXT
Best practice: Forward master node data to the indexer layer

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters