No of search head required.

swathi_dell — Wed, 07 Aug 2019 09:58:01 GMT

Hi,
I am sizing for various ingestion volumes of 1 TB,5 TB,10 TB and 20 TB ,considering 300 GB per indexer and upto 24 users.

As per splunk Documentation search heads are based on no of user but is there anyway where i can find the find the ratio of indexers to search head.

I am able to get number of indexers based on sizing app ,but unable to decide on search heads.
https://splunk-sizing.appspot.com/

for eg: 5 TB , i require 17 indexers but how many search heads?

Can somebody please highlight the general rule to decide on search head depending upon the no of indexers or provide a similar app to calculate no of search head.

Re: No of search head required.

gaurav_maniar — Wed, 07 Aug 2019 11:23:23 GMT

Hi Swathi,

The following documentation might give you the idea for your Search Head requirement.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Capacity/Summaryofperformancerecommendations

Just a suggestion - From existing environment, keep one search head for scheduled jobs or alerts or add extra search head.
It will provide good user experience as all scheduled jobs processing will be handled by non user facing search head.

Accept and upvote the answer if it helps.

topic Re: No of search head required. in Deployment Architecture

No of search head required.

Re: No of search head required.