Can an Indexer be used as both indexer and search head in clustering?

[anushareddy6767]

I've an indexer cluster with 3 nodes and a VM cluster master, I've been using cluster master for primary searching. Can an Indexer be configured to work as both indexer and search head? (which gives me two search heads searching 3 indexer cluster)

[Steve_G_]

Neither of those deployments are supported. The search head, like all other nodes, must reside on its own, separate Splunk Enterprise instance.

For details, see: http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Systemrequirements#Required_Splunk_Enterpr...

[woodcock]

Yes, but particularly in a clustered environment, I highly advise against it. You run the risk of jeapordizing handling incoming data which breaks everything for everybody.

[somesoni2]

Technically it's possible but it'll put load on the Indexer which you'll configure as SH (it has to perform roles of Indexer as well as Search Head).