If we have a single indexer, is there any advantage to have a separate search head?

[di2esysadmin]

Would searches be faster if we put our single indexer on one host and a single search head on another?

I see the simple architecture for multiple indexers and a single search head. But we really don't need more than one indexer.

I'm not convinced there is any gain in splitting the indexer and search functions across two hosts.

Appreciate guidance.

Karla

[BenjaminWyatt · Accepted solution]

General Splunk guidelines state there isn't much benefit to splitting out the search head/indexer functions into separate servers until you have about 4 indexers. You should be fine as you are.

[di2esysadmin]

As I suspected. THANKS!