Within the [clustering] stanza of the server.conf file, the mode attribute defines the functional role of a Splunk instance within an indexer cluster. Splunk documentation identifies three valid modes:
mode = manager
Defines the node as the Cluster Manager (formerly called the Master Node).
Responsible for coordinating peer replication, managing configurations, and ensuring data integrity across indexers.
mode = peer
Defines the node as an Indexer (Peer Node) within the cluster.
Handles data ingestion, replication, and search operations under the control of the manager node.
mode = searchhead
The value “deployer” (Option C) is not valid within the [clustering] stanza; it applies to Search Head Clustering (SHC) configurations, where it is defined separately in server.conf under [shclustering].
Each mode must be accompanied by other critical attributes such as manager_uri, replication_port, and pass4SymmKey to enable proper communication and security between cluster members.
References (Splunk Enterprise Documentation):
• Indexer Clustering: Configure Manager, Peer, and Search Head Modes
• server.conf Reference – [clustering] Stanza Attributes
• Distributed Search and Cluster Node Role Configuration
• Splunk Enterprise Admin Manual – Cluster Deployment Architecture
