Clustering: Can a cluster master also act as a search head?

[akula169]

My current splunk (standalone) index/search host has a bunch of proc/mem but is low on disk. I have two other servers with average proc/mem but a ton of disk that I'd like to use as cluster peers.

I noticed in the first step of clustering configuration, you have the choice of three roles: master, search head or peer. That's making me think its not possible to have a master also be a search head.

I'd like to move the standalone (big proc/mem) over to be a master as well as search. Possible?

[Jon_Webster]

The Master Node does run a Search Head as well. The docs state this and also not to use it for production searching.

From this section in the docs, just below the diagram:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Multisitearchitecture#Multisite_cluster_n...

The master node controls the entire cluster. Although the master resides physically on a site, the master is not actually a member of any site. However, each master has a built-in search head, and that search head requires that you specify a site for the master as a whole. Note that the master's search head is for testing purposes only. Do not use it in a production environment. 

[akula169]

got it. thanks.

[Drainy]

right and as it says, the splunk instance that is a master node must perform only that single role

[akula169]

I'm not asking for the master to also act as a peer. I want the master to also act as the search head.

[Drainy]

Why do you post with so many usernames?

[Drainy · Accepted solution]

As per the docs;
http://docs.splunk.com/Documentation/Splunk/5.0.1/Indexer/Enablethemasternode

Important: A master node cannot do double duty as a peer node. The Splunk instance that you enable as master node must perform only that single role. In addition, the master cannot share a machine with a peer.

[Masterbaker]

Just to add to Ricapar's comment... the docs should at the very least explain why we shouldn't use the master as a search head for production - Is it for performance considerations only (e.g: ensure that the master node has enough resources to accomplish its purpose), or is there some other more important reason?

I'll give you an example : As far as capacity is concerned I only need two search heads for our production environment - but search head clustering requires a minimum of three search heads.

In that case I would gladly use the master node as my "unused" third search head - It would be there only to satisfy the "3 search heads" requirement but not to do actual searching. Would that work, are there any caveats? I cannot draw conclusions from the current documentation. Maybe a Splunk guru here can take a stab at this? Cheers!

[Steve_G_]

See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Systemrequirements#Required_Splunk_Enterp...

[Ricapar]

It seems quite wasteful to dedicate a machine for just the role as a master.

I just finished setting up my own cluster. 1 master, 4 peers. Don't have a dedicated search head quite yet.

However, when a machine is set up as the Master node, it is still capable of performing searches - and those searches work as you'd expect, distributing out to all of the peer nodes.

In that sense, the master can act as a search head.

The docs don't really differentiate between what you CAN and CAN NOT do, and what you SHOULD and SHOULD NOT do. They should.