Question

What is difference between Distributed search head and Search head cluster.

Answer 1

Dear Mahesh,

Hope you are doing great.

Distributed search provides a way to scale your deployment by separating the search management and presentation layer from the indexing and search retrieval layer.

A search head cluster is a group of Splunk Enterprise search heads that serves as a central resource for searching.

Please refer to the below given query which will give you complete details :

https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Whatisdistributedsearch

https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/AboutSHC

Please go through the above links and let us know if you have any further query so that we can help you at earliest.

We will be waiting for your response.

Answer 2

 A distributed environment describes the separation of indexing and searching logic 

In a non-distributed environment, you would have installed all the logic on a single machine, which does the indexing of data and also searches the data.In a clustered environment, you could then combine multiple indexers to an indexer cluster for high-availabily/data loss prevention.

Master Splunk and harness the power of your data – Enroll in our Splunk Course now!