I am new to Splunk and I have to install and configure Splunk on three virtual machines (1 Search Head and a cluster composed of 2 indexers). I went through the Splunk documentation and saw that a master Node is required to handle the behavior of the indexer cluster.
I would like to install both instances, the master node and the search head, on the same VM even if the documentation doesn't recommend it. How could I get it done?
If this task is impossible, how could I configure an indexer without taking into account a master node as the IP address of the master node must be written in the configuration file of any indexer ?
Okay, thank you very much for your answers.
I was also wondering if it is mandatory to have a master node as the cluster isn't that big (only composed of two indexers).
Would it be possible to have an architecture composed of indexers' cluster without any master node ?