1.

State difference between Search head pooling and Search head clustering.

Answer»

Splunk Enterprise instances, also called search heads, distribute search requests to other instances called search peers, that performs the actual data searching and indexing. Results are merged and returned to the user by the search HEAD. You can implement Distributed Search using Search head pooling or Search head clustering in your Splunk deployment. 

  • Search head pooling: Pooling refers to sharing resources in this CONTEXT. It uses shared STORAGE for configuring multiple search heads to share user data and configuration. Quite simply, it allows you to have multiple search heads so they share user data and configuration. MULTIPLYING search heads facilitate horizontal scaling when a lot of users are searching the same data.
  • Search head clustering: In Splunk Enterprise, a search head CLUSTER is a collection of search heads that are used as a centralized resource for searching. All members of the cluster can access and run the same searches, dashboards, and search results.


Discussion

No Comment Found