Splunk defines standard reference architectures: S1 (single server, <20GB/day), C1 (single-site clustered), C3 (multi-site clustered with DR).
The choice depends on availability requirements. C1 provides HA within a single data center. C3 adds geographic disaster recovery with data replicated across sites.