Deployment Architecture

Search Head Cluster that index data



We are analysing Splunk in a HA environment with 2 or 3 instances of Splunk Enterprise that replicate data between them and also configurations and apps. This can be accomplished with a Search Head Cluster (with a deployer) and an Indexer Cluster. It is possible to have both clusters in the same machine? I mean, can a Search Head Cluster also store and index data and replicate it to other members of the Search Head Cluster without the necessity of a separate Indexer Cluster?

Thanks in advanced,

0 Karma


No, you need indexer clusters and search head clusters to have their own machines.

Indexer Clustering docs say no:
Search Head Clustering docs say no:

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!