What is the difference between a Distributed and Clustered environment?

[aoliullah]

Hi. Could someone explain to me the difference between Distributed and Clustered environment in relation to Splunk? I keep thinking it's the same.

Thanks in advance!

[ChrisG]

There is a whole manual specifically about this subject. Start your reading at Scale your deployment with Splunk Enterprise components. The manual includes information about all the dimensions of a distributed deployment, including clustering, and explains a number of typical deployment scenarios.

[skalliger · Accepted solution]

Distributed does not necessarily mean clustered. A distributed environment describes the separation of indexing and searching logic in Splunk. In a non-distributed environment, you would have installed all the logic on a single machine, which does the indexing of data and also searches the data.

In a distributed environment however, you would have an indexer which gets data from several inputs and you would also have a search head, which searches across your indexer.

In a clustered environment, you could then combine multiple indexers to an indexer cluster for high-availabily/data loss prevention (keeping multiple copies of your data). Talking of desaster recover, you would then talk about a multi-site cluster (two clusters at different locations).
Also you would combine multiple search heads together, which distribute their searches to each other. Besides those two clusters, you will also need a deployer and a master (which can be the same machine) to manage your indexer and search head clusters.

Skalli

[gokadroid]

If it's about really differentiating the terms from each other then one way can be of thinking it as , clustering to be within a layer like cluster of indexes, cluster of searchheads. Distributed can be one search head, one indexer, each on different machines.

Technical details of each setup might have some overlaps, but that's the simplest I could think of 🙂