Setting up Splunk search heads

The last component that we will set up is the search head. Remember that the search head is how users access Splunk Web. Follow these steps:

1. Log in to your deploymentserver instance using an SSH client. Refer to step 1 of the Setting up Splunk Deployment Servers section for information on logging in to SSH. Enter yes to the authenticity prompt:

   ssh -i "<your private key>.pem" ec2-user@<your EC2 Instance name or IPv4>

Use the sudo command to change from ec2-user to the splunk user:

sudo -i -u splunk

Use the following command to check that Splunk is running:

/opt/splunk/bin/splunk status

2. Now, let’s set up our search head. First, we will start by changing the hostname and server name, as we did for the forwarders, deployment server, and indexer. Use the following command to change the hostname and server name:

   /opt/splunk/bin/splunk set servername searchhead

   /opt/splunk/bin/splunk set default-hostname...