I have installed and configured Splunk as per below design.
Replication factor - 3
Search Factor - 2
Indexer cluster with 3 node and 1 master node.
Search Head Cluster - 2 (plus master node as deployer server)
1 deployment server
Please share if you have test cases to test Splunk design, connectivity and configuration.
No, 3 SHs plus the deployer (shared in the master in your case)ç
http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/SHCsystemrequirements For example, if your replication factor is either 2 or 3, you need at least three instances.
The minimum number of instances for a SHC is 3