Deployment Architecture

Is it possible to install a master node and a search head on the same VM?


Hi Splunkers,

I am new to Splunk and I have to install and configure Splunk on three virtual machines (1 Search Head and a cluster composed of 2 indexers). I went through the Splunk documentation and saw that a master Node is required to handle the behavior of the indexer cluster.
I would like to install both instances, the master node and the search head, on the same VM even if the documentation doesn't recommend it. How could I get it done?

If this task is impossible, how could I configure an indexer without taking into account a master node as the IP address of the master node must be written in the configuration file of any indexer ?

Thanks in advance.


0 Karma

Revered Legend
0 Karma

Ultra Champion

I would also add -

Since the master node "just" manages the cluster, it's hard to believe that they would collide on resources, but you better monitor the server well.

0 Karma


Okay, thank you very much for your answers.
I was also wondering if it is mandatory to have a master node as the cluster isn't that big (only composed of two indexers).
Would it be possible to have an architecture composed of indexers' cluster without any master node ?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.