Introducing Splunk clusters
A Splunk cluster is a collection of Splunk Enterprise servers working together to ensure that data is available to users. Splunk search head and indexer clusters offer the following:
- Protection against data loss (indexer clusters)
- Data availability (search head and indexer clusters)
- Fault tolerance (search head and indexer clusters)
Search head clusters ensure that the efficiency of a Splunk search is not affected as users and search volume increase. Indexer clusters store Splunk data in a form that ensures that indexes are replicated across members of the cluster.
In the next two sections, we will look at search head and indexer clusters. We’ll explore the role they play in ensuring data loss protection, data availability, and fault tolerance in Splunk deployments. There is also the concept of multisite clustering, where clusters are configured to exist across multiple geographical sites. However, this concept is beyond...
