topic Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286707#M54747 <P>Should I build out a cluster master with the same hardware requirements as my heavy forwarder? </P> Mon, 21 Dec 2015 17:15:31 GMT sbattista09 2015-12-21T17:15:31Z Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286707#M54747 <P>Should I build out a cluster master with the same hardware requirements as my heavy forwarder? </P> Mon, 21 Dec 2015 17:15:31 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286707#M54747 sbattista09 2015-12-21T17:15:31Z Re: Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286708#M54748 <P>That's not enough information to go on with 100% accuracy. BUT, let me tell you about our environment and maybe that'll help.</P> <P>We have two indexers, one searchhead, a handful of heavy forwarders, and hundreds of universal forwarders. When we moved to the two indexer model we just lumped our cluster master in with our deployment server and have had zero issues in over 6-7 months.</P> <P>Hope that helps!</P> Mon, 21 Dec 2015 17:19:28 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286708#M54748 hagjos43 2015-12-21T17:19:28Z Re: Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286709#M54749 <P>glad to hear! we have 4 indexers and about 800 to 1000 UF's. Im looking for a guild line to spec out a Cluster master.</P> Mon, 21 Dec 2015 17:32:51 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286709#M54749 sbattista09 2015-12-21T17:32:51Z Re: Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286710#M54750 <P>Ours is a VM:<BR /> 4 cores, 6 GB of RAM, around 100GB of storage to start (being a VM we can grow it as needed).</P> Mon, 21 Dec 2015 17:46:21 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286710#M54750 hagjos43 2015-12-21T17:46:21Z Re: Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder? https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286711#M54751 <P>Our cluster master and deployment servers were sharing a VM with the following specs until very recently: 4 cores, 4 GB RAM, 50GB dedicated drive. We had 2000 UFs and 6 indexers.</P> <P>The minimum spec I would go for nowadays is the following:</P> <UL> <LI>Intel 64-bit chip architecture, 2 cores, 2 GHz</LI> <LI>2GB RAM</LI> <LI>OS installation + 50GB free</LI> <LI>Standard 1Gb Ethernet NIC, with optional second NIC for a management network</LI> <LI>Linux 3.x 64-bit edition</LI> </UL> <P>If you can afford it get 4 cores and 4GB RAM.</P> <P>Hope that helps.</P> <P>Regards,<BR /> Javier</P> Tue, 22 Dec 2015 08:39:06 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-build-out-a-cluster-master-with-the-same-hardware-spec/m-p/286711#M54751 javiergn 2015-12-22T08:39:06Z