https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332737#M12417 <P>I am going to building a small Splunk cluster with 3 Splunk instances and would like all nodes be able to do indexing and search. But in Splunk documents, index master, index peer node, and search head seem to be sepearted. </P> <P>Is it possible to configure a single Splunk instance being index master, index peer node, and search head? Is the configuration same as the normal Splunk cluster?</P> Fri, 28 Jul 2017 09:15:55 GMT danielwan 2017-07-28T09:15:55Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332737#M12417 <P>I am going to building a small Splunk cluster with 3 Splunk instances and would like all nodes be able to do indexing and search. But in Splunk documents, index master, index peer node, and search head seem to be sepearted. </P> <P>Is it possible to configure a single Splunk instance being index master, index peer node, and search head? Is the configuration same as the normal Splunk cluster?</P> Fri, 28 Jul 2017 09:15:55 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332737#M12417 danielwan 2017-07-28T09:15:55Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332738#M12418 <P>Hi danielwan<BR /> from <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Basicclusterarchitecture">http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Basicclusterarchitecture</A></P> <P><EM>Master nodes, peer nodes, and search heads are all specialized Splunk Enterprise instances. All nodes must reside on separate instances and separate machines. For example, the master node cannot reside on the same instance or machine as a peer node or a search head.</EM></P> <P>We created for a customer an Indexer Cluster (two peers and Master Node) where there are both Indexer and Search Head roles on the peers, but only indexes are replicated.<BR /> Master Node MUST be on a different instance.</P> <P>Bye.<BR /> Giuseppe</P> Fri, 28 Jul 2017 11:44:51 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332738#M12418 gcusello 2017-07-28T11:44:51Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332739#M12419 <P>Thanks for the explaination.<BR /> do you mean even search header and peer node must be different hosts?</P> Fri, 28 Jul 2017 12:15:58 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332739#M12419 danielwan 2017-07-28T12:15:58Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332740#M12420 <P>Master Node must be on a different server.<BR /> It's better (raccomanded by Splunk) that Search Head and Indexer are on different servers but we have one installation where they are on the same servers.<BR /> In other words we have two peers (both with indexer and search head) and a Master node<BR /> Bye.<BR /> Giuseppe</P> Fri, 28 Jul 2017 12:21:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332740#M12420 gcusello 2017-07-28T12:21:25Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332741#M12421 <P>one more question,in your installation where both search head and index peer node reside on the same host, is it a search head cluster or a single search head.if it is a search head cluster,is search artifact replicated properly?</P> <P>also what is the value of "mode" of server.conf as one single host is both search head and peer node?</P> Fri, 28 Jul 2017 12:54:51 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332741#M12421 danielwan 2017-07-28T12:54:51Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332742#M12422 <P>You can install splunk in an "all-in-one" configuration where a single host is all of these: License Master, Indexer, Search Head, Forwarder, Monitoring Console and Deployment Server (but it cannot deploy to itself). As far as clustering goes, no, you cannot run either a Search Head Cluster or an Indexer Cluster on a single host; it really makes no sense.</P> Fri, 28 Jul 2017 13:29:49 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332742#M12422 woodcock 2017-07-28T13:29:49Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332743#M12423 <P>Hi danielwan,<BR /> indexes are replicated between peers, instead search artifacts aren't replicated between peers.<BR /> We created a script that replicates knowledge objects from one server to the second.<BR /> Our script repicate all objects with the only exception of lookups.<BR /> Bye.<BR /> Giuseppe</P> Sat, 29 Jul 2017 15:04:12 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332743#M12423 gcusello 2017-07-29T15:04:12Z https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332744#M12424 <P>Is this for learning/testing purposes? In production you should do everything that you can to have 1 role per server.</P> Sat, 29 Jul 2017 15:12:52 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-it-possible-to-configure-a-single-splunk-instance-being-index/m-p/332744#M12424 woodcock 2017-07-29T15:12:52Z