i have got the task to design an "as-small-as-possible" cluster in our test-demo-environment
According to the gui-aided cluster-installation in Splunk Enterprise 6.2.x you have to assign only one role to each cluster member:
as a search head
as a cluster-master
or as an indexer.
is it feasable or not recommended to use a single search head as the cluster master (and 2 indexers) in a 6.2.x cluster?
This will technically work, however, it is not recommended to overload the cluster master as a search head for performance reasons. If this is a "test demo" environment, go for it.
View solution in original post