Within the [clustering] stanza of the server.conf file, the mode attribute defines the functional role of a Splunk instance within an indexer cluster. Splunk documentation identifies three valid modes:
* mode = manager
* Defines the node as the Cluster Manager (formerly called the Master Node).
* Responsible for coordinating peer replication, managing configurations, and ensuring data integrity across indexers.
* mode = peer
* Defines the node as an Indexer (Peer Node) within the cluster.
* Handles data ingestion, replication, and search operations under the control of the manager node.
* mode = searchhead
* Defines a Search Head that connects to the cluster for distributed searching and data retrieval.
The value "deployer" (Option C) is not valid within the [clustering] stanza; it applies to Search Head Clustering (SHC) configurations, where it is defined separately in server.conf under [shclustering].
Each mode must be accompanied by other critical attributes such as manager_uri, replication_port, and pass4SymmKey to enable proper communication and security between cluster members.
References (Splunk Enterprise Documentation):
* Indexer Clustering: Configure Manager, Peer, and Search Head Modes
* server.conf Reference - [clustering] Stanza Attributes
* Distributed Search and Cluster Node Role Configuration
* Splunk Enterprise Admin Manual - Cluster Deployment Architecture