Splunk® Validated Architectures

Splunk Validated Architectures

Single Server Deployment (S1)

The following diagram represents a single sever deployment topology:
This diagram shows a single sever deployment topology.

Architecture overview

The Single Server Deployment topology is typically used for smaller, non-business critical use-cases that are often departmental in nature. It provides a very simple, cost effective solution if your environment meets all of the following criteria:

  • You do not have any requirements to provide high availability or automated disaster recovery for your Splunk software deployment.
  • Your daily data ingest is less than approximately 500 GB.
  • You have a small number of users with non-critical search use cases.


The primary benefits of this topology include the following:

  • Simple administration, performant search for smaller data volumes, and a fixed total cost of ownership (TCO).
  • Multiple independent single-instance deployments can be managed by a single management tier.
  • Straightforward migration path to a distributed deployment.


The primary limitations of this topology include the following:

  • No high availability for search or indexing.
  • Scalability limited by hardware capacity.
Last modified on 15 February, 2024
Topology components   Distributed Clustered Deployment - Single Site (C1 / C11)

This documentation applies to the following versions of Splunk® Validated Architectures: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters