HA with just 2 indexers?

[nonexpert]

Can this be done or is the official Splunk guidance to utilize an index cluster?

Curious if there's any current (potentially) possible method to achieve high-availability with only 2 indexers?

My reading on index clusters has me thinking one needs at a minimum 3 licensed Splunk instances. At least, that's what I got from Splunk's documentation. You need one master, and at least 2 dedicated indexer peers. Where the search head goes in all of that and how that would be supported, I have no clue.

I'm sure everyone can think of a very green reason as to why one would want to be able to just have a pair of indexers serve high availability without being forced into an index cluster kind of deployment.

I can see older posts where apparently this used to be supported but my understanding now is that the only Splunk supported high-availability deployment is via index clusters.

Can anyone confirm?

[richgalloway]

The answer depends on your definition of "HA".  If you only care that your data has some place to go then having (at least) 2 indexers qualifies.  OTOH, if it's the data itself that must be HA then unclustered indexers is/are not the answer.  That's because loss of an indexer means loss of the data stored on that indexer.  SmartStore helps by putting warm buckets in off-box storage, but hot buckets remain on the indexer unprotected.

In an indexer cluster, each bucket is replicated to at least one other indexer so the loss of an indexer does not result in data loss.

Yes, an indexer cluster requires a cluster manager, but that instance can be shared with the Monitoring Console/License Manager instance.

[PickleRick]

Just to nitpick a little. You can set up a cluster without redundancy. It's not a HA cluster but it has its uses (one advantage of such setup is the ability to rebalance buckets when you add a new peer).

But yes, if you set up a cluster with RF>=2, every bucket should have at least one additional copy somewhere in the cluster.