Can a hardware and a software indexer(virtual indexer) be clustered?

[damode]

As the title suggests, is it possible to do that? logically it seems possible but I am not sure what performance impact it would have on the functioning of the cluster.

Hence, please suggest if this is possible and any points that should be taken into consideration.

Thank you.

[adonio]

hello there,

please read here:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Systemrequirements#Summary_of_key_requirem...
to your question, is ti possible? yes it is possible, everything (almost) is possible.
is it supportable? arguably if you have the same OS and splunk version
is it recommended? not very much, VMs tend to be weaker (if they have same specs) than physical machines, also, shared storage and maybe shared network can become bottlenecks for performance.
lastly, when you have more than 1 indexer (clustered or not) and a search head that searches against them, the performance is as strong as the weakest indexer.
it is highly recommended (only because i couldnt find in docs a statement that says: "cant do VM and physical with same specs")almost to a required degree that all your indexers will be exactly the same, specialty when clustered

hope it helps