Deployment Architecture

Can A Single Master Cluster Node support multiple clusters?


Let's say I have two groups of two indexers, each group in its own cluster. Can I use a single master cluster node to control both clusters, or must I deploy one for each?

0 Karma


In theory, with enough hardware and documentation so you don't confuse future you, you could put two different Splunk installations on a single server, and each installation controls a different cluster... But a single Splunk installation cannot be the cluster master for multiple different clusters. (It can control a single multi-site cluster, but this is rather different than having two separate clusters)

Simply structurally it cannot happen within a single installation first, server.conf is where ultimately you would put your cluster configuration, and there's a single [clustering] stanza for the cluster master to set its details (SF/RF) for the cluster. See and

Furthermore there's the problem of pushing configuration to the slaves which comes from a single $SPLUNK_HOME/etc/master-apps as well.

So technically you could have a single Node, it's not a single installation on a single Node.


Yes, you can use single Master node

0 Karma


Not true. Each cluster has exactly one master node. The cluster can have any number of peer nodes and search heads

0 Karma


Can you share your background info on this?

0 Karma