topic Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head? in Deployment Architecture

in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

arlakathena — Tue, 04 Dec 2018 15:38:10 GMT

I have Splunk distributed 7.2.1 (1 dedicated Search Head with multilple non clustered indexers)

I am wondering if there is a limit of indexers by a single dedicated search head ( how many indexers can a search head support ? )
i am planning on adding a distant instance of Splunk Enterprise as an indexer over VPN (based on client request). Is that possible ?

Note: the dedicated search head is acting as deployment server and license manager as well.

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

prakash007 — Tue, 04 Dec 2018 17:40:21 GMT

I don't think there is a limit in this case, for instance we had a stand-alone search head with 20peers(indexers)
You can add as long as the Search Head is able to communicate with the Indexer over VPN, but you might encounter some network latency.

This splunk doc might give you an idea on scaling your infrastructure..
http://docs.splunk.com/Documentation/Splunk/7.2.1/Capacity/Summaryofperformancerecommendations

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

Anonymous — Wed, 05 Dec 2018 15:16:50 GMT

The Search head uses "URL:8089"
As long as it can connect to it should not be any problems.

But the underlaying infastructure may be using som CPU resources. Is the VPN a software or is it Site2Site vpn.
You will most likely encounter some lag, but I think it wil work.

But it all depends on network and the cpu/memory of the Search head.
The indexer you are pulling data from wil not even know if youre on another network.

But if you can reach the indexer/peer via the VPN tunnell you are all good.

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

jmaple_splunk — Thu, 06 Dec 2018 01:25:54 GMT

Out if curiousity, would the remote indexer you're planning on better suited as a heavy forwarder that just sends traffic back to your main indexers at the other end of the VPN tunnel? Seems like the easiest way to avoid latency issues depending on the distance.

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

arlakathena — Thu, 06 Dec 2018 08:57:44 GMT

When the client chooses that the data stays stored locally at his side we can't judge him! also i would need another indexer at my side to receive parsed event coming from the heavy forwarder as you suggested!

My point here that i would search data through my dedicated Search Head (no local storage/index) to the indexer(at the client side) via VPN, data will be stored there, his license will be a slave of my license manager

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

arlakathena — Thu, 06 Dec 2018 09:02:42 GMT

The Search Head is deployed with the best practice hardware requirements so i don't think there will be a problem there.
The best way i'm planning this is on a Site2Site VPN, i think the network capacity is extensible so logically there is no problem.

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

Anonymous — Thu, 06 Dec 2018 11:13:23 GMT

Please let us know how it went, if you are experiencing lag then you could adjust the timeout on the Search head.

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

arlakathena — Tue, 26 Feb 2019 15:52:19 GMT

It's working for 2 months now !
no break ups or failures

Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?

Anonymous — Wed, 27 Feb 2019 07:49:42 GMT

Wonderful:)