Hi,
Is it possible to create a single search head instance ?
And or a single indexer instane? - Or are the instances by default indexers?
Hi and welcome,
when you are downloading, installing and starting Splunk, you would have a single-instance (often called "all in one" instance). Please refer to the docs for an explanation of this.
Splunk scales from a single server to multiple ones, both Search Heads and indexers. This is referred to as a distributed deployment and described here in the docs.
Please use Google to search through Splunk Docs or Answers as they're visible to anyone and this question has been asked quite a few times. 🙂
Skalli