Hi Splunkers,
I am new to Splunk and I have to install and configure Splunk on three virtual machines (1 Search Head and a cluster composed of 2 indexers). I went through the Splunk documentation and saw that a master Node is required to handle the behavior of the indexer cluster.
I would like to install both instances, the master node and the search head, on the same VM even if the documentation doesn't recommend it. How could I get it done?
If this task is impossible, how could I configure an indexer without taking into account a master node as the IP address of the master node must be written in the configuration file of any indexer ?
Thanks in advance.
Alex
Technically it can but it's not recommended, specially for Production. See these links
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Enablethemasternode
https://answers.splunk.com/answers/71201/clustering-can-a-cluster-master-also-act-as-a-search-head.h...
I would also add -
http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/Aboutclusters
Since the master node "just" manages the cluster, it's hard to believe that they would collide on resources, but you better monitor the server well.
Okay, thank you very much for your answers.
I was also wondering if it is mandatory to have a master node as the cluster isn't that big (only composed of two indexers).
Would it be possible to have an architecture composed of indexers' cluster without any master node ?