topic Re: Clustering queries in Deployment Architecture

Clustering queries

SplunkFu — Wed, 03 Apr 2013 16:08:52 GMT

Hi there,

We are currently looking at the using clustering to introduce redundancy/HA into the deployment. I have a few questions which I may have missed in the documentation...

Is there a minimum number of peer nodes that can be used in a cluster? - we are looking at 2 nodes, are there any major restrictions to this setup?
In the documentation it states that a reference server should suffice for the master node, however as it is not performing any indexing/searching does it require that much in specification?
Any issues with using clustering with the ES App?
Are there any issues in having a search head searching between clustered and non-clustered indexers/nodes?
Finally, I didn't see any notes on how to calculate storage requirements for clustering. Any thoughts?

Thanks in advance, and I look forward to your help 🙂

Best regards...

Re: Clustering queries

Steve_G_ — Wed, 03 Apr 2013 18:34:00 GMT

I can help with a few of these:

Minimum number of peer nodes: Depends of course on your availability needs, but you can certainly set up a cluster with just two peer nodes.

Storage requirements: Many factors enter into it, but there's some pretty extensive documentation here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Systemrequirements#Storage_considerations

Re: Clustering queries

gkanapathy — Wed, 03 Apr 2013 20:35:12 GMT

No, two indexer nodes is fine.
You can and probably should use a much smaller server for the master node. It doesn't need anything near the storage or CPU of any indexer. Probably a dual-core machine with 2 or 4 GB of memory and no big storage is fine.
There should not be, except that summaries/tsidxstats will not be stored on the cluster
You can not do this. A search head can search many non-clustered nodes, or it can search many clusters, but it can't do both. It's probably worth making an Enhancement Request for this if you want it
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Systemrequirements#Storage_considerations

Re: Clustering queries

SplunkFu — Thu, 04 Apr 2013 07:41:46 GMT

Thanks for the response... completely missed that documentation page... thought I clicked through them all. +1

Re: Clustering queries

SplunkFu — Thu, 04 Apr 2013 07:42:42 GMT

Thanks for the response, very helpful... can't believe I missed that webpage.

Re: Clustering queries

SplunkFu — Thu, 04 Apr 2013 07:43:51 GMT

also... how do I submit an enhancement request... not done one before.

Re: Clustering queries

gkanapathy — Thu, 04 Apr 2013 15:00:48 GMT

You can submit a enhancement request by submitting a case here https://www.splunk.com/page/submit_issue and setting it to priority level P4.

Re: Clustering queries

SplunkFu — Fri, 05 Apr 2013 12:51:31 GMT

Ahh right, okay that's great thanks. Will do, thanks