Splunk server roles

[splunkreal]

Hello,

could you explain me in details the possible roles of cluster member below and what would you advice for :

2 search heads
2 indexers
1 management console (cluster master at least, deployment server & SHC deployer?)

Thanks a lot.

[gcusello · Accepted solution]

Hi realsplunk,
I suggest to read http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture and http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture

Anyway in Search Head cluster you have:

• Search Head Captain
• Search Heads
• Deployer: manage replication between SHs

Note that in Search Head Cluster you must have at least 3 SHs.

In Indexer Cluster you have

• Search Peers (at least 2)
• Master Node

Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders

Bye.
Giuseppe

[splunkreal]

Thanks cusello, however why 3 SHs are required? Is there any doc on this requirement?

[gcusello]

See http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCsystemrequirements#Required_number_o...
Anyway for a lab you can also use only two SHs!

Bye.
Giuseppe

[splunkreal]

Thank Giuseppe, we use virtual machines FYI but yes I just read 3 SHs are better in case one search head fails.