Hi I have a setup of 2Search Heads + 1 SearchHead(also Used as Deploymnet Server) + 6 Indexes
As of now there is no replication of data.But now we want to implement index clustering with replication factor of 2 or more(still deciding) for data availabilty in case of indexer down.
I was wondering if i could convert the SearchHead/Deployment Server to act as MasterNode for clustering & Deployment Server.
Because we cannot afford to add one more server to stack and make it as master node for index clustering
Though not recommended but you can make your deployment server as master node for indexer clustering as long as you meet the minimum hardware configuration wherein the forwarder management will take care of the forwarders and the indexer clustering will manage the clustered indexers.
No, the recommended setup is for the master to be a separate instance. (The master node is the only one with the cluster-wide view of the system and is the node that initiates any corrective action; so while it is not as loaded as the indexers, it is still recommended that it being a separate splunk instance.)