Deployment Architecture

Is it possible to install a master node and a search head on the same VM?

ameslet
Explorer

Hi Splunkers,

I am new to Splunk and I have to install and configure Splunk on three virtual machines (1 Search Head and a cluster composed of 2 indexers). I went through the Splunk documentation and saw that a master Node is required to handle the behavior of the indexer cluster.
I would like to install both instances, the master node and the search head, on the same VM even if the documentation doesn't recommend it. How could I get it done?

If this task is impossible, how could I configure an indexer without taking into account a master node as the IP address of the master node must be written in the configuration file of any indexer ?

Thanks in advance.

Alex

0 Karma

somesoni2
Revered Legend
0 Karma

ddrillic
Ultra Champion

I would also add -
http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/Aboutclusters

Since the master node "just" manages the cluster, it's hard to believe that they would collide on resources, but you better monitor the server well.

0 Karma

ameslet
Explorer

Okay, thank you very much for your answers.
I was also wondering if it is mandatory to have a master node as the cluster isn't that big (only composed of two indexers).
Would it be possible to have an architecture composed of indexers' cluster without any master node ?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...