topic Distributed Indexer Hardware in Getting Data In

Distributed Indexer Hardware

ckillg — Thu, 24 Sep 2015 14:33:18 GMT

I'm working to purchase additional indexers, but am trying to figure out what would be the best configuration of servers.

Essentially, I can purchase one R730 with 24 hard disks in a RAID 10, or I can buy 4 R550s, each with 8 hard disks in a raid 10. Both server configs would have 2 CPUs and however much RAM I wanted (I understand the requirements are low).

I am trying to accelerate searches and provide redundancy and recovery more than trying to increase indexing rate or volume.

I can try to provide more information if needed. I've read through the sizing documentation, and I can't find any concrete recommendations for disk configuration.

Neill

Re: Distributed Indexer Hardware

Yasaswy — Thu, 24 Sep 2015 14:51:40 GMT

Hi,

I would go the route of more indexers /servers... your data will be better distributed and will provide opportunities for faster searches. Will provide more options on clustering side as well. (More servers typically better than a single server for indexer)

From disk standpoint you can find some info here

Re: Distributed Indexer Hardware

grijhwani — Thu, 24 Sep 2015 15:06:15 GMT

If redundancy is what you want then the rule of not keeping all your eggs in one basket is definitely the way to go. A cluster of multiples is the far better route, and for a bonus you get easier maintainability, too. (Having the option to drop one of 4 out of the pile leaving the other 3 to take up the load in the meantime is a boon to maintenance operations.)

Re: Distributed Indexer Hardware

ckillg — Thu, 24 Sep 2015 15:19:15 GMT

Any idea if SSDs make a significant difference in search speed?

Re: Distributed Indexer Hardware

ckillg — Thu, 24 Sep 2015 15:36:47 GMT

found this http://blogs.splunk.com/2012/05/10/quantifying-the-benefits-of-splunk-with-ssds/