https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473544#M16492 <P>Thank you, I used your solution.</P> Sat, 04 Jan 2020 05:10:08 GMT jg91 2020-01-04T05:10:08Z https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473542#M16490 <P>Hello friends,<BR /> We want to deploy splunk in a new site and we have 2 powerful server with SSD storage, We need to have data high availability and our current plan is to install one indexer on each server and use 1 Heavy Forwarder on 3rd server to send data to both indexers.<BR /> Is this plan good enough or there is a better plan like using indexer clustering and install cluster master on 3rd server?<BR /> Please share your suggestions with me about deployment architecture with 2 server.<BR /> Thanks,</P> Tue, 31 Dec 2019 06:01:05 GMT https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473542#M16490 jg91 2019-12-31T06:01:05Z https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473543#M16491 <P>Use an indexer cluster to replicate your data.</P> <P>Forcing a HF to send data to two indexers creates more problems than it solves. Your license will be hit twice. Your searches will return duplicate results. Any failure to connect to indexer (like during maintenance) means your data is no longer in two places. Clustering resolves all of these issues.</P> Tue, 31 Dec 2019 13:47:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473543#M16491 richgalloway 2019-12-31T13:47:30Z https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473544#M16492 <P>Thank you, I used your solution.</P> Sat, 04 Jan 2020 05:10:08 GMT https://community.splunk.com/t5/Deployment-Architecture/Help-on-Splunk-deployment-plan/m-p/473544#M16492 jg91 2020-01-04T05:10:08Z