Hello,
Environment overview:
2 Data Centers
1 Datecollector
1 Splunk enterprise 6X Server working as a search head, Indexer
in each DC
Now I plan to implement a Splunk 6.4.x Indexer cluster. How many servers do I need?
1 As Master node
1 as Search Head
2 Peer Nodes
Is this correct?
Can I install the Master Node and Search Head on the Same Server?
And what about the replication factor (I have 2 Peers) - so the Replication Factor is 2?
Thanks for your support
Hi,
For cluster you need 5 instances
2 - indexer
1 - master
1 - license master
1 - search head
You can put license master and cluster master in the same instance and is ok. But no a search head.
2 - indexer
1 - master / license master / deployment server
1- search head
Other interesting thing is to have in each DC a HF .
And replication factor 2 is correct.
Hope i help you.