Hi @thevikramyadav ... all the best for your splunk learning..
remember these 3 components...
1) Splunk Universal forwarder collects the logs and send it to Splunk indexer.
2) Splunk indexer, indexes(ingests) the logs(it reads the logs, word by word, and write it down to flat files for searching)
3) Splunk Search head - its the webserver which provides the Splunk GUI login page, it reads the search requests from the users and send it to indexer. and collects the results from indexer, consolidates, reports it.
From Splunk documentations:
In a distributed search environment, a Splunk Enterprise instance that handles search management functions, directing search requests to a set of search peers and then merging the results back to the user.
A Splunk Enterprise instance can function as both a search head and a search peer. A search head that performs only searching, and not any indexing, is referred to as a dedicated search head.
Search head clusters are groups of search heads that coordinate their activities.
Search heads are also required components of indexer clusters.
