Hi, thanks for the update. the reason why i want to go for this setup is that, when many people start searching for the data , it will create the lot of load on search node. am i right? is this how splunk work ? sorry i am new to the splunk. i am not sure whether the load create on search node or indexer. http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/SHCarchitecture i am looking for the similar setup. my main concern is load on search node. If i want to do the setup like above, will it be stable ? is there any difficulty i will face ? ... View more