Need some understanding of Splunk server roles?

[mgiddens]

I'm rearranging my Splunk server roles, and I noticed that if I remove SH role from my indexer, I still get the options to configure search peers? I seem to misunderstand what the server roles really do the for the Splunk instance because I imagined that only a server configured as a search head would have this option available? Can someone please explain exactly what the server roles both do for a Splunk server and what functionality it takes away from a server not having a role if any?

[ragedsparrow · Accepted solution]

The Server roles are typically central around your function as well as populating the monitoring console dashboards. Enterprise Splunk has the ability to function as any of these roles. If you take the server role off of one of the servers, that typically is only used for ensuring that the monitoring console places/removes that server from the relevant dashboard. You still have the ability to utilize all of the functions that Splunk Enterprise has to offer, you just typically don't utilize functions that you don't need for that server's role (i.e. Having search peers on indexers).

Does that clear anything up?

[mgiddens]

This is exactly what I needed. Thanks for the timely response and yes that clears it up quite nicely! Makes alot more sense now based on what I was seeing.

Regards

mgiddens

[ragedsparrow]

Awesome! Glad I could help!