Searching Clustered Indexes

[jacs]

Can I cluster two Splunk nodes for data availability without having a search head node? In other words, use one or both of the indexer nodes as a searcher / indexer - like it would be in a single node system.

( I understand that I would have to have a cluster manager on an entirely separate node.)

Thanks.

[mahamed_splunk]

You are asking if search head and peer can be run from the same machine under clustering. No, this is not supported combination.

You can run search head on the same instance as master, though.

BUT, from high availability standpoint, it is always recommended to run each component of cluster in a separate server.