Back to Floor
The Entrance Hall • Room 3
Single vs. Distributed Deployments
In a single-instance deployment, one Splunk server handles all functions: data collection, indexing, and searching. This is fine for small environments or testing.
In a distributed deployment, these roles are split across multiple servers for scalability and performance. Search Heads, Indexers, and Forwarders each run on dedicated machines.
Most production environments use distributed deployments. As data volume grows, you scale by adding more Indexers and Forwarders.
A good rule of thumb: if you're ingesting more than 20 GB/day, you should consider a distributed deployment.
Knowledge Check
Prove your understanding to clear the room (Rewards XP)
Question 1 of 2
When would you use a single-instance deployment?