Configure the search head with server.conf

Prerequisites

Before reading this topic, see Configure the indexer cluster with server.conf. It discusses configuration issues that are common to all cluster node types.

Enable a search head

The following example shows the basic settings that you must configure when enabling a search head node. The configuration attributes shown here correspond to fields on the Enable clustering page of Splunk Web.

[clustering]
manager_uri = https://10.152.31.202:8089
mode = searchhead
pass4SymmKey = whatever

This example specifies that:

• the search head's cluster manager node resides at 10.152.31.202:8089.
• the instance is a cluster search head.
• the security key is "whatever".

Edit the search head settings

You can change these settings later, if necessary. For example, to change the cluster's security key, you change the pass4SymmKey value on each node.

You can also configure the search head to search across multiple indexer clusters or across clustered and non-clustered search peers. See:

• Search across multiple indexer clusters
• Search across both clustered and non-clustered search peers.