Connect a search head cluster to a multisite indexer cluster

Configure a SearchHeadCluster resource to communicate with a multisite indexer cluster by setting the cluster manager reference and multisite default parameters.

Search head clusters do not have site awareness for artifact replication, so mapping Splunk sites to Kubernetes zones is not relevant in that context.

Connect SearchHeadCluster resources to a multisite indexer cluster the same way as for single site. Reference the name of the IndexerCluster part containing the cluster manager in the clusterManagerRef parameter.

Set the following additional Ansible default parameters to activate multisite:

  • multisite_master: reference the cluster manager service of the target indexer cluster.
  • site: in general, set to site0 to disable search affinity. See the Splunk documentation for more details.

For all available default parameters, see default.yml.spec.md in the splunk-ansible repository.

Create a SearchHeadCluster resource with the multisite parameters.
CODE 
cat <<EOF | kubectl apply -n splunk-operator -f -
---
apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: example
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  replicas: 3
  image: "splunk/splunk:9.4.0"
  clusterManagerRef:
    name: example
  defaults: |-
    splunk:
      multisite_master: splunk-example-cluster-manager-service
      site: site0
EOF