thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Splunk Search Head

The Splunk component that provides the user interface and distributes searches to indexers.

Definition

Search heads handle search management, dashboards, reports, alerts and knowledge objects, merging results returned by indexers. Search head clusters share configuration and provide high availability, coordinated by a captain. Premium apps such as Enterprise Security run on search heads.

Example

An analyst running a correlation search from the Enterprise Security search head.

Exam tip

Search heads do not store indexed data; they coordinate searches across indexers.

Related terms