A replication factor of 1 means that you will have just one copy of your data, the same as you would have if you were employing a non-clustered indexer. In order to replicate the data and achieve some measure of high availability, you need a replication factor of at least 2.
Assuming that you do want two copies of your data, set the replication factor to 2. However, you then need at least two peer nodes. You also need one master node and one search head. In total, you need four Splunk Enterprise instances to deploy such a scenario.
... View more