There are many ways you can implement
specific aspects of this architecture.
For guidance, talk with Splunk
This second solution has the advantage
that it depends less on the
capabilities of your underlying
storage system. On the downside, it
requires double the hardware (since
you're doubling the indexers), as well
as a license for twice the indexing
volume (since you're indexing
If you want true HA, then yes, your going to need to have an indexer set up in HA to act as a license server. Sales can provide you with a HA specific license, iirc, at a reduced cost. Don't quote me on that particular piece.