Deployment Architecture

Splunk Standalone Instance - Is clustering available for high availability>

Path Finder


We have a single standalone Splunk instance used for indexing, searching and alerts.
We want to have high availability in case one server goes down, but want to know if we can set up clustering so that Splunk manages the distribution of users/knowledge objects automatically.

I know that search head clustering and index clustering is possible, but not sure about a standalone instance as we can't see anything in the documentation...


Tags (1)
0 Karma

Esteemed Legend

What EXACTLY do you mean by Standalone Instance?

0 Karma

Esteemed Legend

@gcusello is describing Index(er) Clustering which protects the data. There is also Search Head Clustering to provide access to searchability.
Copied from the Distributed Search Manual:

Required number of instances
The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

  • Three members, so that the cluster can continue to function if one member goes down. See "Captain election process has deployment implications."
  • The replication factor number of instances. See "Choose the replication factor for the search head cluster."

For example, if your replication factor is either 2 or 3, you need at least three instances. If your replication factor is 5, you need at least five instances.

You can optionally add more members to boost search and user capacity (and complexity and fragility).

0 Karma

Path Finder

Thanks @woodcock

Can you confirm if search head clustering will work with standalone instances?
So i assume the knowledge objects (searches, alerts, dashboards etc) will be clustered, but i'm wondering will the underlying data also be clustered with SH clustering?

OR are you saying that we'd move to distributed environment and do SH and IDX clustering for full HA?

0 Karma

Esteemed Legend

Neither of these options work with All-in-one architecture. For Indexers, you need multiple indexers and a Cluster Master. For Search Heads, you need multiple Search Heads.

0 Karma


Hi @smcdonald20,
until the version 6.x it was possible to have two standalone clustered Splunk servers, from the version 7.x it isn't possible to do this because searches on clustered Indexers don't run.
You need at least:

  • two Indexers;
  • one Master Node (it isn't possible to use an Indexer for this role);
  • at least one Search Head (it isn't possible to use the Master Node or one Indexer for this role).

In few words you need at least four servers.

In addition if you want HA also on Search Heads:

  • if you want a real HA, you need at least three Search Heads and a Deployer (that could be shared with the Master Node),
  • if you want a cold HA, you need at least two Searche Heads, and you have to manually manage the objects replication between Search Heads.


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!