Instance on private subnets

[stevehouel]

Hi everyone,

Is there any reason for not deploying indexer and search head instances into a private subnets and only put the LoadBalancer into public ?

Sorry for my dummy question and thx for your answers.

[billbartlett]

It's possible to do it this way, but you wouldn't have access to the search head if you didn't deploy a search head cluster (SHC). The ELB for search heads is only created if SHC is enabled. You'd also lose any ability to send data to the indexers from subnets that weren't local to the indexers and you weren't peering to.

Essentially, the Splunk QuickStart is intended as a baseline that works for most situations 'out of the box', but you're free to edit it in any manner you'd like to fit your specific need.