Advanced Deployments - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 371

deployment server
Usually on port 8089, the deployment server listens using SSL, by default, with a
self-signed certificate. There are a couple of problems with using a load balancer
with the deployment server; they are as follows:

• The protocol is essentially REST over HTTP, but not quite. Use a TCP load
balancer, not a load balancer that understands HTTP.
• While it is theoretically possible to load balance deployment servers, the
issue is that, if the different deployment servers are out of sync, deployment
clients may "lap", loading one set of apps and then the other. A better
approach is probably running multiple deployment servers and using
DNS or load balancers to ensure that certain sets of hosts always talk to a
particular server.

Multiple search heads
Using the search head pooling feature, it is possible to run multiple search head
instances. The feature requires a share of some sort behind the servers acting as
search heads, which effectively means they must be in the same data center. The
setup looks essentially like the following figure:

In short, the steps to configure the search are as follows:

1. Mount the NFS volume on each search head.
2. Enable the pooling feature on each instance.
3. Copy the existing configurations to the NFS volume.
4. Test the search heads.

5. Enable the load balancer.

The official documentation is available at http://docs.splunk.com/
Documentation/Splunk/latest/Deploy/Configuresearchheadpooling .