Ok… this question and the answers are a bit older, but maybe my post could help other Splunkers. You need up to two kinds of services: Splunk (with Splunk Web) as an SH Cluster Member and a Load Balancer (optional). "Optional" because you can also configure it so that User A has to use SHC Node 1, User B has to use SHC Node 2, and User C has to use SHC Node 3, or keep the other nodes as a kind of hot spare. …If you choose a Load Balancer (which makes sense outside of Dev or Test environments), it does not necessarily need to be an external one for a Search Head Cluster. A customer used a 3-node SH Cluster in production. On 2 nodes, an additional Apache instance was installed as an LB and configured for high availability (HA) by swapping the Virtual IP for the SH Cluster. I just finished the Splunk Cluster Administration Course. There they use just 3 virtual machines for a multisite cluster and SH cluster with deployer and manager node. Kind Regards SierraX
... View more