topic Re: Splunk cluster in Deployment Architecture

Splunk cluster

498773 — Wed, 21 Aug 2013 10:26:25 GMT

Please suggest the best practise for splunk deployment

Considerations:

Index data of size 2GB daily
Data comes from 20 different hosts
Report generation on data

Proposed Solution:

Search Factor=2, Replication Factor=2
20 forwarders to pull data from hosts
One master node, Two Peer Nodes(for Indexing) , One Search head
Data on each node would be 1GB (considering RF and SF)

My question is does this set up looks good or can i avoid search head as there are only two indexers, please suggest some best practices . Do i really need to go for cluster set up if not what can be done ?????

looking forward for your ideas, Thanks in advance

Re: Splunk cluster

kristian_kolb — Wed, 21 Aug 2013 10:59:13 GMT

No, you don't need to have a cluster. It's a design decision which will give you added fault tolerance. Given the rather small amount of data you're indexing, a single server will most likely satisfy your capacity needs (depending on the amount of searches you will actually be making - scheduled or manual).

NB: with a cluster like you specified, the storage on each node will be 2GB daily, not 1GB, since you duplicate all your data (SF=2, RF=2). Thus it's 4GB spread over 2 indexers.

Re: Splunk cluster

498773 — Wed, 21 Aug 2013 12:01:48 GMT

Thanks kristian