can we store data on search head ???

[krushivasani]

Generally indexer is used to store indexes but in the standalone architecture how data is stored ???  

[erikwie · Accepted solution]

The splunk instance with the indexer role is storing data.

In a standalone architecture the single server is perfoming all the roles.

[isoutamo]

As already said, normally events are stored into indexes which are in same server than search head on all-in-one server case. In distributed environments those are in different servers. Then there are lookups and kvstore files, which are always stored on search head side.

r. Ismo

[SinghK]

Standalone works as all in one server and it stores data too..