What goes where ?
Very simple, the application lives only on search head:
| Splunk Instance
(role) |
Install ? |
|---|
| Standalone server |
X |
| Search head (single instance or clustered) |
X |
| Indexer (single instance or clustered) |
|
| Master node |
|
| Deployment servers |
|
| Heavy Forwarder |
|
| Universal Forwarder |
|