Deployment Architecture

Master and Search Head together?

michael_lee
Path Finder

Is it possible to configure Master and Search head together in one spunk instance? If it is, what should I take note of?
thanks

Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

As per splunk documentation,

A master node cannot do double duty as a peer node or a search node. The Splunk Enterprise instance that you enable as master node must perform only that single indexer cluster role. In addition, the master cannot share a machine with a peer. 

Additional roles for the master node

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

You can use the master's built-in search head for debugging purposes.
You might be able to run a search head cluster deployer on the master, depending on the master's load.
You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

30 indexers
100,000 buckets
10 indexes
10 search heads

Reference : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Enablethemasternode

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

As per splunk documentation,

A master node cannot do double duty as a peer node or a search node. The Splunk Enterprise instance that you enable as master node must perform only that single indexer cluster role. In addition, the master cannot share a machine with a peer. 

Additional roles for the master node

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

You can use the master's built-in search head for debugging purposes.
You might be able to run a search head cluster deployer on the master, depending on the master's load.
You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

30 indexers
100,000 buckets
10 indexes
10 search heads

Reference : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Enablethemasternode

Happy Splunking!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...