topic What is Needed resource for CM, LM, DS, HF, DMC in Splunk Search

What is Needed resource for CM, LM, DS, HF, DMC

jg91 — Fri, 01 May 2020 18:49:22 GMT

Hi,
We plan to deploy Splunk with indexer clustering (with 3 indexers) in our company.
We know the hardware requirements for indexers and search heads, but it's not clear to us what recourses (CPU Cores, RAM, Storage) are needed for Cluster Master, License Master, Deployment Server, Heavy Forwarders, DMC.
Is there any recommendation for these components?
Thanks!

Re: What is Needed resource for CM, LM, DS, HF, DMC

richgalloway — Fri, 01 May 2020 19:15:02 GMT

The DMC (now called "MC") is just a search head and can be configured as such. Heavy forwarders are indexers that don't store data.
Splunk recommends all instances follow the Hardware Reference. You can get away with much lighter instances, but if you have problems Support may expect you to meet the minimum specs before helping.

You can, however, combine many of the roles into two instances. HFs will always be their own instances, but you can combine any of the others as long as the CM and DS are separate. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/Systemrequirements#Additional_roles_for_the_master_node.

Re: What is Needed resource for CM, LM, DS, HF, DMC

prachisaxena — Fri, 01 May 2020 20:03:33 GMT

For all the management servers, use the reference hardware of 12GB RAM and 12 cores.
All of these have low disk requirements. Deployment Server and Cluster master has medium cpu and memory requirements. Rest has low cpu/mem requirement.

If Deployment Server will be deploying to more than 50 clients, then it must run on a dedicated instance and One server can safely handles approximately 2000+ polls/minute (Windows) and 10,000 + polls/minute (Linux)

Cluster Master cannot be shared with Indexer or Search heads but can share the roles of Monitoring Console or Deployer, under certain circumstances.

Monitoring console should have dedicated instance so that only administrators can have access to it. But it can run on shared instance with some caveats

Deployer can be deployed on dedicated instance or dedicated deployment server or cluster master node.

Re: What is Needed resource for CM, LM, DS, HF, DMC

prachisaxena — Fri, 01 May 2020 20:10:14 GMT

check this link https://docs.splunk.com/Documentation/Splunk/8.0.3/Deploy/Manageyourdeployment

Re: What is Needed resource for CM, LM, DS, HF, DMC

jg91 — Fri, 01 May 2020 20:18:39 GMT

Thanks for your help.

Re: What is Needed resource for CM, LM, DS, HF, DMC

jg91 — Sat, 02 May 2020 00:18:40 GMT

Thanks, is low-speed disk good for HF?

Re: What is Needed resource for CM, LM, DS, HF, DMC

richgalloway — Mon, 04 May 2020 12:25:02 GMT

Yes. HF does little disk I/O so disk speed is not a factor.