Deployment Architecture
Highlighted

What is the difference between a Distributed and Clustered environment?

Path Finder

Hi. Could someone explain to me the difference between Distributed and Clustered environment in relation to Splunk? I keep thinking it's the same.

Thanks in advance!

0 Karma
Highlighted

Re: What is the difference between a Distributed and Clustered environment?

Motivator

If it's about really differentiating the terms from each other then one way can be of thinking it as , clustering to be within a layer like cluster of indexes, cluster of searchheads. Distributed can be one search head, one indexer, each on different machines.

Technical details of each setup might have some overlaps, but that's the simplest I could think of 🙂

Highlighted

Re: What is the difference between a Distributed and Clustered environment?

SplunkTrust
SplunkTrust

Distributed does not necessarily mean clustered. A distributed environment describes the separation of indexing and searching logic in Splunk. In a non-distributed environment, you would have installed all the logic on a single machine, which does the indexing of data and also searches the data.

In a distributed environment however, you would have an indexer which gets data from several inputs and you would also have a search head, which searches across your indexer.

In a clustered environment, you could then combine multiple indexers to an indexer cluster for high-availabily/data loss prevention (keeping multiple copies of your data). Talking of desaster recover, you would then talk about a multi-site cluster (two clusters at different locations).
Also you would combine multiple search heads together, which distribute their searches to each other. Besides those two clusters, you will also need a deployer and a master (which can be the same machine) to manage your indexer and search head clusters.

Skalli

View solution in original post

Highlighted

Re: What is the difference between a Distributed and Clustered environment?

Splunk Employee
Splunk Employee

There is a whole manual specifically about this subject. Start your reading at Scale your deployment with Splunk Enterprise components. The manual includes information about all the dimensions of a distributed deployment, including clustering, and explains a number of typical deployment scenarios.