I have installed and configured Splunk as per below design.
Replication factor - 3
Search Factor - 2
Indexer cluster with 3 node and 1 master node.
Search Head Cluster - 2 (plus master node as deployer server)
1 deployment server
Please share if you have test cases to test Splunk design, connectivity and configuration.
Maybe you have a typo in your question, but you can´t have a SHC with 2 SHs, you need at least 3
Search Head Cluster - 2 (plus master node as deployer server - total -3)
No, 3 SHs plus the deployer (shared in the master in your case)ç
http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/SHCsystemrequirements For example, if your replication factor is either 2 or 3, you need at least three instances.
The minimum number of instances for a SHC is 3
I have 3 node SHC. with replication_factor - 3 and search_factor - 2
pls share test cases if you have.
Maybe you can use this app to benchmark your architecture