Your Cribl deployment strategy progresses through three foundational blueprints:

• Single-instance deployment: Collapses the Leader and Worker/Edge Node functions onto a single host for non-production use, labs, and PoCs, offering no High Availability (HA) or scalability.

• Distributed: Single Worker Group/Fleet: The default production archetype, using one Leader and one Worker Group/Fleet with multiple Nodes sized for N-1 capacity to provide HA and horizontal scaling for localized data.

• Distributed: Multi-Worker Group/Fleet: Necessary when complexity requires independent scaling and logical segregation, establishing a foundation of two or more distinct Worker Groups/Fleets to manage issues like security boundaries, workload interference, or operational agility before applying advanced functional or regional overlays.

These foundational topologies are often enhanced by Overlays, which are additive patterns like Functional Split or Regional Split that define the specific logical partitioning rules applied to the Multi-Worker Group structure.