Use clusters for high availability and ease of management

You can group certain Splunk Enterprise components into clusters, so that they closely coordinate their activities. This serves two key purposes:

• High availability
• Ease of management

Indexer clusters

An indexer cluster is a group of Splunk Enterprise indexers that are configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk Enterprise data, the cluster prevents data loss while promoting data availability for searching.

Splunk Enterprise clusters feature automatic failover from one indexer to the next. This means that, if one or more indexers fail, incoming data continues to get indexed and indexed data continues to be searchable.

Besides enhancing high availability, clusters have other features that help to simplify the management of a distributed deployment. For example:

• They include a capability to coordinate configuration updates easily across all indexers in the cluster.
• They include a built-in distributed search capability.
• They feature indexer discovery, which enables the set of forwarders to automatically load-balance across all indexers in the cluster.

Even if high availability is not a concern in your environment, you can still take advantage of the simplified management features by deploying an indexer cluster without index replication.

For guidance on implementing an indexer cluster, see "High availability deployment: Indexer cluster."

Search head clusters

A search head cluster is a group of search heads that serves as a central resource for searching. The search heads share knowledge objects, apps, and all other configurations. You can run the same searches, view the same dashboards, and access the same search results from any search head in the cluster.

Search head clusters provide several important benefits:

• Horizontal scaling. As the number of users and the search load increases, you can add new search heads to the cluster. By combining a search head cluster with a third-party load balancer placed between users and the cluster, the topology can be transparent to the users.
• High availability. If a search head goes down, you can run the same set of searches and access the same set of search results from any other search head in the cluster.
• No single point of failure. The search head cluster uses a dynamic captain to manage the cluster. If the captain goes down, another search head automatically takes over management of the cluster.

For guidance on implementing a search head cluster, see "Medium to large enterprise deployment: Search head cluster with multiple indexers."