splunk architect for indexers and searches

[kml_uvce]

Currently I am using splunk like this
one splunk server(machine) that having search head, indexes(in one splunk server more indexers)

i saw the doc http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview
I did not get in this doc, more search heads are in diffrent servers(more than one machine) and indexers are in diffrent servers (more than one machine) or all are in same server(machine) and also about the forwarders pushing data.

can anyone please explain me this architecture ? and also if you have any better architect then please let me know.

[sdaniels · Accepted solution]

These links will probably be helpful to you in understanding the basic Splunk architecture for a single server. Essentially you have the Search Head, Indexer, Forwarder all on the same server. We have the capabilities to distribute those components to multiple servers in order to scale our environment.

This explains the different components which you have all on one server.
http://docs.splunk.com/Documentation/Splunk/latest/Installation/ComponentsofaSplunkdeployment

This explains a more logical representation of the inner functions of a Splunk server. Diagram towards the bottom of the page.
http://docs.splunk.com/Documentation/Splunk/4.3.1/Installation/Splunksarchitectureandwhatgetsinstall...

[sdaniels]

Not sure what you mean. You are able to have multiple indexers and search heads on multiple servers in order to scale your environment and improve performance for processing increased amounts of data. A typical indexer is good for about 100 GB of data per day, a typical search head running on an 8 core server will allow for 8 concurrent searches.

[kml_uvce]

do you mean that we can also do diffrent search heads in diffrent servers and diffrent indexers in diffrent servers ?