We have a single server that is running indexer, master and search head. As we only have 1 server, it is a single point of failure.
We were thinking to put in place Splunk cluster solution, so our Splunk infrastructure would be resilient.
To deploy Splunk cluster we were thinking to use 2 servers:
* Server A: Indexer, master, search head.
* Server B: Indexer, master in standby, search head.
Master Node must manage Peers so cannot be located on one of them (there are addressing problems!);
if you run a search on Indexers (in other words use one Indexer as Search Head) you don't have results (from version 7.0.0).
you need at least 4 servers (2 Indexers, 1 Master Node, 1 Search Head) to have HA at data level, but not at search level (this means that dashboards, reports and alerts have a Single Point of Failure).
To have a full HA architecture, you need 6 or 7 servers:
Hey, your recommendation above is not supported neither recommended. The minimum number of instances to deploy Splunk on an Indexer Cluster will be 4 servers (2x indexers, 1x SH and 1x CM). Cluster Master is a relatively low resource server and you can use a smaller VM to accomplish that role. When you setup the Indexer Cluster and choose your instance type you can only chose one, that means you can't really have a CM and an Indexer together.
If you just have two physical hosts, you might want to virtualise them and create separate instances on those physical servers. Just make sure you have enough resources if virtualising. You can read this paper: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf