Adding a New Member to Your Existing Search Head Cluster

Are you looking to expand your existing Search Head Cluster (SHC) with a new member? If so, this article will walk you through the steps needed to add a new member to your SHC while using LDAP authentication.

First, let's start by mentioning that placing a separate `nf` file on each SHC member manually, with the cleartext LDAP password in it, is not the official way to do things. In fact, having passwords stored in cleartext is generally considered insecure.

Instead, you should consider using the recommended method of encrypting your passwords. To do this, create a new `nf` file with the same stanza as in the app, and add the `bindDNpassword` line back in there, but this time with the password entered in encrypted form.

Once you have your new `nf` file set up, you can proceed to deploy it to your SHC using the Deployer. To do this, simply run the command `splunk deploy -target :`.

After deploying the app, you'll need to add the new member to your SHC. To do this, run the following command: `splunk add shcluster-member -currentmemberuri :`. Replace `` with the URI of the current member, and `` with the management port number.

After adding the new member, you may need to restart each machine in the SHC. Once restarted, you should be able to log on to the SHC members using LDAP authentication without any trouble.

It's also a good idea to test your settings on a separate machine before deploying them to your SHC. This can help ensure that everything is working as expected before you make changes to your production environment.

By following these steps, you should be able to add a new member to your existing Search Head Cluster using LDAP authentication without any issues.

Splunk search head cluster