Can you use both mounted and shared bundles with the same index cluster?

[ckurtz]

I have a dedicated search pool using mounted bundles to talk to our index cluster.

Can I also have a standalone search head using normal shared bundles talk to the same clustered indexers?

I'm currently using Splunk 5, upgrades to 6 are a few months out.

[yannK · Accepted solution]

seems possible.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Howclusteredsearchworks

As with a non-clustered distributed search, you can have multiple search heads, and the search heads can function as a single unit, known as a search head pool. And, just like non-clustered distributed searches, you can use mounted bundles to reduce the amount of data that gets passed from the search head to the peers.

[ckurtz]

Yann is correct. If search heads aren't configured to use mounted bundles they default to the normal method (sending the bundle over the wire to the indexer.)