Is it possible to use a single search-head as the cluster-master with 2 indexers in a 6.2.x cluster environment?

[rschoensee]

Hello,

i have got the task to design an "as-small-as-possible" cluster in our test-demo-environment

According to the gui-aided cluster-installation in Splunk Enterprise 6.2.x you have to assign only one role to each cluster member:
as a search head
as a cluster-master
or as an indexer.

is it feasable or not recommended to use a single search head as the cluster master (and 2 indexers) in a 6.2.x cluster?

Best Regards
Ralf

[schoi · Accepted solution]

This will technically work, however, it is not recommended to overload the cluster master as a search head for performance reasons. If this is a "test demo" environment, go for it.