https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339852#M12677 <P>Thank Giuseppe, we use virtual machines FYI but yes I just read 3 SHs are better in case one search head fails.</P> Tue, 31 Oct 2017 14:20:48 GMT splunkreal 2017-10-31T14:20:48Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339848#M12673 <P>Hello,</P> <P>could you explain me in details the possible roles of cluster member below and what would you advice for :</P> <P>2 search heads<BR /> 2 indexers<BR /> 1 management console (cluster master at least, deployment server &amp; SHC deployer?)</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3758iE033E6690C5AFF7B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Thanks a lot.</P> Tue, 31 Oct 2017 13:35:59 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339848#M12673 splunkreal 2017-10-31T13:35:59Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339849#M12674 <P>Hi realsplunk,<BR /> I suggest to read <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture">http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture</A> and <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture">http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture</A></P> <P>Anyway in Search Head cluster you have:</P> <UL> <LI>Search Head Captain</LI> <LI>Search Heads</LI> <LI>Deployer: manage replication between SHs</LI> </UL> <P>Note that in Search Head Cluster you must have at least 3 SHs.</P> <P>In Indexer Cluster you have</P> <UL> <LI>Search Peers (at least 2)</LI> <LI>Master Node</LI> </UL> <P>Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders</P> <P>Bye.<BR /> Giuseppe</P> Tue, 31 Oct 2017 13:51:57 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339849#M12674 gcusello 2017-10-31T13:51:57Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339850#M12675 <P>Thanks cusello, however why 3 SHs are required? Is there any doc on this requirement?</P> Tue, 31 Oct 2017 14:12:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339850#M12675 splunkreal 2017-10-31T14:12:46Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339851#M12676 <P>See <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCsystemrequirements#Required_number_of_instances">http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCsystemrequirements#Required_number_of_instances</A><BR /> Anyway for a lab you can also use only two SHs!</P> <P>Bye.<BR /> Giuseppe</P> Tue, 31 Oct 2017 14:17:13 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339851#M12676 gcusello 2017-10-31T14:17:13Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339852#M12677 <P>Thank Giuseppe, we use virtual machines FYI but yes I just read 3 SHs are better in case one search head fails.</P> Tue, 31 Oct 2017 14:20:48 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-roles/m-p/339852#M12677 splunkreal 2017-10-31T14:20:48Z