Splunk Enterprise deployment design

Splunk Enterprise supports three types of deployment: single instance deployment, distributed deployment, and clustered deployment. While all these deployment options are valid, the distributed deployment is the most similar to the configurations described here.

Figure 8 shows the Splunk Enterprise single instance deployment that combines the indexer and search head into a single server node.

Figure 8.         Splunk Enterprise single instance deployment

Figure 9 shows the Splunk Enterprise distributed deployment with one search head, one indexer, and one master node (admin server). Here the indexer data is stored once and distributed across available indexers when there is more than one indexer.

Figure 9.         Splunk Enterprise distributed deployment

Figure 10 shows the Splunk Enterprise clustered deployment with one search head, two indexers, and one master node (admin server). This type of deployment targets clients requiring high data availability, since the indexers are configured to replicate each others’ data.

Figure 10.     Splunk Enterprise clustered deployment