Hello @danieljackson For High availability, you should have Search Head and Indexer Cluster in place. So that in case of any failure on Indexer side or search head side it can easily achievable through additional SH and Indexer. Now lets discuss about your first concern: The best approach is to have a VIP enabled which can load balanced the load in case of any failure on indexer side. And in case of any issue with universal forwarder as the logs are getting stored in a file, so no need to worry once you fix the issue with universal forwarder, the logs will start moving from the same point itself so no duplication. second concern: Mostly everyone has a single master server. And you are correct here, the logs will still be indexed without any concerns, just replication of buckets will be a issue for some time. ... View more