Getting Data In
Highlighted

Can an Indexer be used as both indexer and search head in clustering?

I've an indexer cluster with 3 nodes and a VM cluster master, I've been using cluster master for primary searching. Can an Indexer be configured to work as both indexer and search head? (which gives me two search heads searching 3 indexer cluster)

0 Karma
Highlighted

Re: Can an Indexer be used as both indexer and search head in clustering?

SplunkTrust
SplunkTrust

Technically it's possible but it'll put load on the Indexer which you'll configure as SH (it has to perform roles of Indexer as well as Search Head).

0 Karma
Highlighted

Re: Can an Indexer be used as both indexer and search head in clustering?

Esteemed Legend

Yes, but particularly in a clustered environment, I highly advise against it. You run the risk of jeapordizing handling incoming data which breaks everything for everybody.

0 Karma
Highlighted

Re: Can an Indexer be used as both indexer and search head in clustering?

Splunk Employee
Splunk Employee

Neither of those deployments are supported. The search head, like all other nodes, must reside on its own, separate Splunk Enterprise instance.

For details, see: http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Systemrequirements#Required_Splunk_Enterpr...