Deploy a single-member search head cluster

For limited purposes, you can deploy a single-member search head cluster. This approach allows you to start with a small distributed search deployment and easily scale to a larger cluster later.

Why a single-member cluster?

The main benefit of a search head cluster is to provide high availability search. To fulfill that benefit, the cluster must comprise at least three members. See Captain election process has deployment implications.

If you do not require high availability and you need only the capacity provided by a single search head, you can deploy a non-clustered search head.

However, even if your current needs can be met by a single search head, you might want to deploy a single-member search head cluster rather than a non-clustered search head. This approach ensure a simple path to future expansion. When you are ready to scale your deployment's search capacity, you can expand the single-member cluster into a cluster of three or more members, thereby gaining access to high availability and the other benefits of a full-fledged cluster.

As an alternative to starting your distributed search deployment with a single-member cluster, you can start with a non-clustered, standalone search head. Although a non-clustered search head is simpler to deploy initially than a single-member search head cluster, scaling your search capacity in the future becomes a more complicated process, because it involves migrating the settings from the non-clustered search head to a search head cluster. See Migrate settings from a standalone search head to a search head cluster.

Deploy a single-member cluster

To deploy a single-member search head cluster, follow the same deployment procedure as you would for a multi-member cluster. See Deploy a search head cluster.

Note the following:

• The single member is also the cluster captain.
• You must choose a separate Splunk Enterprise instance to function as the deployer.
• You must set the replication factor on the member to 1.

The role of the deployer

In a search head cluster, the deployer distributes all apps and certain other configurations to the cluster members. See Use the deployer to distribute apps and configuration updates. You must use the deployer to distribute apps and other configurations.

Do not install apps and other similar configurations directly on the member. If you do, the configurations will not get added properly to new members when you later expand the cluster.

Scale the cluster to three or more members

When scaling the cluster, expand directly from the single member to a three-member cluster. A two-member cluster is not an inherently stable topology, due to the captain election process. Therefore, a two-member cluster is acceptable only for a brief period, during the process of scaling from one to three members.

To add new members to the cluster, follow the procedure described in Add a new member.

After you add the new members, update the replication factor on each member to the desired value for the expanded cluster, usually 3. All members must use the same value for the replication factor. See Choose the replication factor for the search head cluster.

3 is the default value for the replication factor. Therefore, if you choose to use 3 as the value, you only need to update the setting on the original member, which you previously set to 1 at the time of the initial deployment.