Splunk search heads, either stand-alone or in a cluster, based on your input during deployment. In the latter case, the search heads are distributed across the number of Availability Zones you specify. Splunk license server and indexer cluster master, co-located. Splunk search head deployer, where applicable.
https://aws.amazon.com/quickstart/architecture/splunk-enterprise/