Deployment Architecture

Can the indexer cluster master itself decide to be a search head?


Hello Team,

I am very curious to know the answer of this question.

I have an index clustering setup consisting of one license manager, two index peer nodes, and one index master node.

I never defined any of the nodes as a search head node. However, when I click on search head tab under settings --> Index Clustering in index master Splunk Web UI, it show me the master indexer node host name, even though I never defined indexer master node as a search head node.

Can anyone explain me how does it show index master node as search head node also?


0 Karma

Splunk Employee
Splunk Employee

The indexer cluster requires a dedicated search head. See

The master node does have search head capabilities, but they can only be used for debugging purposes. See


All nodes will default as a search head

The basic configuration of the search head node occurs during initial deployment of the indexer cluster. You can edit the configuration later.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...