Can the indexer cluster master itself decide to be a search head?

[shahk]

Hello Team,

I am very curious to know the answer of this question.

I have an index clustering setup consisting of one license manager, two index peer nodes, and one index master node.

I never defined any of the nodes as a search head node. However, when I click on search head tab under settings --> Index Clustering in index master Splunk Web UI, it show me the master indexer node host name, even though I never defined indexer master node as a search head node.

Can anyone explain me how does it show index master node as search head node also?

Regards,K
Krimesh

[Steve_G_]

The indexer cluster requires a dedicated search head. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Systemrequirements#Required_Splunk_Enterpr...

The master node does have search head capabilities, but they can only be used for debugging purposes. See http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Systemrequirements#Additional_roles_for_th...

[skoelpin]

All nodes will default as a search head

The basic configuration of the search head node occurs during initial deployment of the indexer cluster. You can edit the configuration later.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Configurethesearchhead