Deployment Architecture

Master and Search Head together?

michael_lee
Path Finder

Is it possible to configure Master and Search head together in one spunk instance? If it is, what should I take note of?
thanks

Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

As per splunk documentation,

A master node cannot do double duty as a peer node or a search node. The Splunk Enterprise instance that you enable as master node must perform only that single indexer cluster role. In addition, the master cannot share a machine with a peer. 

Additional roles for the master node

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

You can use the master's built-in search head for debugging purposes.
You might be able to run a search head cluster deployer on the master, depending on the master's load.
You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

30 indexers
100,000 buckets
10 indexes
10 search heads

Reference : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Enablethemasternode

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

As per splunk documentation,

A master node cannot do double duty as a peer node or a search node. The Splunk Enterprise instance that you enable as master node must perform only that single indexer cluster role. In addition, the master cannot share a machine with a peer. 

Additional roles for the master node

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

You can use the master's built-in search head for debugging purposes.
You might be able to run a search head cluster deployer on the master, depending on the master's load.
You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

30 indexers
100,000 buckets
10 indexes
10 search heads

Reference : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Enablethemasternode

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.