https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104193#M26980 <P>Currently I am using splunk like this<BR /> one splunk server(machine) that having search head, indexes(in one splunk server more indexers)</P> <P>i saw the doc <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview</A><BR /> I did not get in this doc, more search heads are in diffrent servers(more than one machine) and indexers are in diffrent servers (more than one machine) or all are in same server(machine) and also about the forwarders pushing data.</P> <P>can anyone please explain me this architecture ? and also if you have any better architect then please let me know.</P> Thu, 29 Mar 2012 13:38:47 GMT kml_uvce 2012-03-29T13:38:47Z https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104193#M26980 <P>Currently I am using splunk like this<BR /> one splunk server(machine) that having search head, indexes(in one splunk server more indexers)</P> <P>i saw the doc <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview</A><BR /> I did not get in this doc, more search heads are in diffrent servers(more than one machine) and indexers are in diffrent servers (more than one machine) or all are in same server(machine) and also about the forwarders pushing data.</P> <P>can anyone please explain me this architecture ? and also if you have any better architect then please let me know.</P> Thu, 29 Mar 2012 13:38:47 GMT https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104193#M26980 kml_uvce 2012-03-29T13:38:47Z https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104194#M26981 <P>These links will probably be helpful to you in understanding the basic Splunk architecture for a single server. Essentially you have the Search Head, Indexer, Forwarder all on the same server. We have the capabilities to distribute those components to multiple servers in order to scale our environment.</P> <P>This explains the different components which you have all on one server.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Installation/ComponentsofaSplunkdeployment">http://docs.splunk.com/Documentation/Splunk/latest/Installation/ComponentsofaSplunkdeployment</A></P> <P>This explains a more logical representation of the inner functions of a Splunk server. Diagram towards the bottom of the page.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Installation/Splunksarchitectureandwhatgetsinstalled">http://docs.splunk.com/Documentation/Splunk/4.3.1/Installation/Splunksarchitectureandwhatgetsinstalled</A></P> Thu, 29 Mar 2012 14:04:29 GMT https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104194#M26981 sdaniels 2012-03-29T14:04:29Z https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104195#M26982 <P>do you mean that we can also do diffrent search heads in diffrent servers and diffrent indexers in diffrent servers ?</P> Thu, 29 Mar 2012 22:40:35 GMT https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104195#M26982 kml_uvce 2012-03-29T22:40:35Z https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104196#M26983 <P>Not sure what you mean. You are able to have multiple indexers and search heads on multiple servers in order to scale your environment and improve performance for processing increased amounts of data. A typical indexer is good for about 100 GB of data per day, a typical search head running on an 8 core server will allow for 8 concurrent searches.</P> Tue, 03 Apr 2012 17:22:35 GMT https://community.splunk.com/t5/Splunk-Search/splunk-architect-for-indexers-and-searches/m-p/104196#M26983 sdaniels 2012-04-03T17:22:35Z