topic Re: Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment? in Getting Data In

Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

horsefez — Thu, 14 Jan 2016 12:01:38 GMT

Hi,

I'm planning on deploying a Splunk infrastructure.

I'm currently undecided whether I should build the infrastructure according to the following configurations.

Multisite-Cluster hosted across two data centers with one ESX Server each
Bare Metal Virtualization
1 Master Node residing on only one of the data centers
1 Search Head for each data center (hosted on ESX)
1 Indexer for each datacenter (hosted on ESX)
OR
2 Indexers for each datacenter (hosted on ESX)

With 1 indexer on each site, I planned to have a replication factor of 2 and a search factor of 2 and a site-rep-factor of 1.
With 2 indexers on each site a replication factor of 4 and a search factor of 3 and a site-rep-factor of 2.

Is it advisable to host 2 smaller indexers instead of one big indexer?
Are there performance benefits or caveats?

Regards,
pyro_wood

Re: Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

lguinn2 — Thu, 14 Jan 2016 21:53:30 GMT

Multi-site clustering requires at least 2 indexers per site. Both of them must meet Splunk's minimum requirements.

Re: Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

horsefez — Fri, 15 Jan 2016 09:23:50 GMT

Thank you, I didn't take this into consideration

Re: Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

jbrocks — Mon, 16 Sep 2019 12:22:41 GMT

I think you could also have a multi site cluster with one site and one indexer