(A customer wishes to keep costs to a minimum, while still implementing Search Head Clustering (SHC). What are the minimum supported architecture standards?)

Question

Options

• AThree Search Heads and One SHC Deployer
• BTwo Search Heads with the SHC Deployer being hosted on one of the Search Heads
• CThree Search Heads but using a Deployment Server instead of a SHC Deployer
• DTwo Search Heads, with the SHC Deployer being on the Deployment Server

• A
  86% (38)
• B
  2% (1)
• C
  2% (1)
• D
  9% (4)

Explanation

Splunk Enterprise officially requires a minimum of three search heads and one deployer for a supported Search Head Cluster (SHC) configuration. This ensures both high availability and data consistency within the cluster. The Splunk documentation explains that a search head cluster uses RAFT-based consensus to elect a captain responsible for managing configuration replication, scheduling, and user workload distribution. The RAFT protocol requires a quorum of members to maintain consistency. In practical terms, this means a minimum of three members (search heads) to achieve fault tolerance - allowing one member to fail while maintaining operational stability. The deployer is a separate Splunk instance responsible for distributing configuration bundles (apps, settings, and user configurations) to all members of the search head cluster. The deployer is not part of the SHC itself but is mandatory for its proper management. Running with fewer than three search heads or replacing the deployer with a Deployment Server (as in Options B, C, or D) is unsupported and violates Splunk best practices for SHC resiliency and - Search Head Clustering Overview - Minimum Supported Architecture - Deploy and Configure the Deployer for a Search Head Cluster - High Availability and Fault Tolerance with RAFT in SHC

No community discussion yet for this question.