Getting Data In

Single Search Head/Single Indexer (distributed search)


Is it possible to create a single search head instance ?
And or a single indexer instane? - Or are the instances by default indexers?

0 Karma


Hi and welcome,

when you are downloading, installing and starting Splunk, you would have a single-instance (often called "all in one" instance). Please refer to the docs for an explanation of this.
Splunk scales from a single server to multiple ones, both Search Heads and indexers. This is referred to as a distributed deployment and described here in the docs.

Please use Google to search through Splunk Docs or Answers as they're visible to anyone and this question has been asked quite a few times. 🙂