Understanding the difference between a search head and an indexer is a core requirement for anyone preparing for Splunk interviews. These two components sit at the heart of distributed search and directly impact query execution, system performance, and overall scalability. While they work closely together, their responsibilities are very different and often confused by beginners.
This blog breaks down search head vs indexer concepts in a simple, interview-friendly way. It focuses on splunk internals, performance roles, and how distributed search actually works behind the scenes. By the end, you should be able to confidently explain their roles, communication flow, and real-world impact during interviews.
Search Head vs Indexer: Interview Questions and Answers
1. What is a Search Head in Splunk?
Answer: A search head is the component responsible for handling user interactions and search logic. It provides the interface where users write and run searches, create dashboards, alerts, and reports.
From an interview perspective, you can describe the search head as the brain of query execution. It does not store raw data permanently. Instead, it distributes search requests to indexers, collects results, applies search-time knowledge, and presents the final output to the user.
Key responsibilities include managing knowledge objects, parsing SPL, coordinating distributed search, and optimizing query execution.
2. What is an Indexer in Splunk?
Answer: An indexer is responsible for data storage and indexing. It receives raw data from forwarders, processes it through the indexing pipeline, and stores it in indexes for fast searching.
In interviews, it helps to explain that indexers do the heavy lifting at index time. They handle event processing, timestamp extraction (_time), event line breaking, and writing data to disk. During a search, indexers execute the search on their local data and return results to the search head.
In simple terms, indexers store and search the data, while search heads ask the questions.
3. How does distributed search work between search head and indexer?
Answer: Distributed search allows a search head to run a single search across multiple indexers. When a user runs a query, the search head breaks it into sub-searches and sends them to all relevant indexers.
Each indexer performs local query execution on its indexed data and returns partial results. The search head then merges, enriches, and formats these results before displaying them.
In interviews, this is a key concept tied to search head vs indexer communication and distributed search architecture. It also highlights why search heads do not need access to raw data files.
4. What happens during query execution in a distributed environment?
Answer: Query execution starts on the search head. The search head parses the SPL, checks permissions, and identifies which indexers contain relevant data.
Indexers then execute the search pipeline execution locally. They apply index-time fields, filter events, and send matching results back. The search head performs final processing, such as field extraction, lookups, and visualization logic.
This division of labor improves performance and scalability, which is often emphasized in performance roles interview questions.
5. What is the role of search head in performance optimization?
Answer: The search head plays a critical role in search optimization. It decides how searches are dispatched, controls concurrency, and manages resource usage across indexers.
It also applies knowledge objects like field extractions, tags, and event types at search time. Poorly designed searches or excessive knowledge objects can overload the search head, even if indexers are healthy.
In interviews, mentioning that search head performance issues often show up as slow dashboards or delayed searches can score extra points.
6. What is the role of indexer in performance optimization?
Answer: Indexers impact performance by how efficiently they store and retrieve data. Proper index design, correct sourcetype configuration, and efficient parsing configuration (props.conf & transforms.conf) directly affect search speed.
Indexers handle indexing phase tasks such as typing phase and parsing phase. If indexers are overloaded, searches may return slowly or time out, even if the search head is functioning well.
Interviewers often expect candidates to understand that indexer bottlenecks are usually CPU, disk I/O, or storage-related.
7. How do search head and indexer communicate?
Answer: Search head and indexer communication happens over secure channels using splunkd. This communication includes search requests, result sets, and metadata exchange.
In distributed environments, this communication must be reliable and efficient. SSL communication is commonly used to ensure secure data transmission. Any disruption in this communication can lead to incomplete or failed searches.
From an interview standpoint, this topic connects directly to search head and indexer communication and cluster communication concepts.
8. Where does search-time processing occur?
Answer: Search-time processing occurs mainly on the search head. This includes field extraction, applying lookups, tags, and calculating derived fields.
Indexers return raw or partially processed results, but the search head finalizes the output. This separation ensures flexibility, as changes to knowledge objects do not require reindexing data.
Understanding search time processing versus index time processing is a common interview checkpoint.
9. Where does index-time processing occur?
Answer: Index-time processing occurs on indexers. This includes event line breaking, timestamp extraction, assigning host field, source field, and sourcetype configuration.
Once data is indexed, index-time decisions cannot be easily changed without reindexing. Interviewers often test whether candidates understand the long-term impact of index-time choices.
10. Can a search head store data?
Answer: A standalone search head does not store indexed data for searching. It may store artifacts such as search results, summaries, and configuration files, but not raw event data meant for indexing.
This is a classic interview trick question in search head vs indexer discussions. The expected answer is that indexers store searchable data, not search heads.
Conclusion
Search head vs indexer is one of the most fundamental Splunk interview topics. The search head focuses on query execution, user interaction, and search-time processing, while the indexer handles data storage, indexing, and index-time processing.
In a distributed search setup, both components work together to deliver scalable and high-performance searches. Knowing where processing happens, how communication flows, and how performance roles differ helps you answer interview questions with clarity and confidence. If you can explain these concepts in simple terms, you are already ahead of many candidates.
