Splunk App for VMware: What are best practices for scaling with multiple search heads?

[jsmith39]

I'm installing the VMware app to monitor a rather large environment (1000+ esxi hosts, 10+ vCenters) and I'm not having a lot of luck finding rules for scaling.

I can only presume that a single search head/scheduler is not going to handle the load gracefully, but I'm not sure what the best practices are for using multiple SH's and how that affects the end user, whether the scheduler can handle the load, or if it can be broken into pieces, etc.

[bbingham]

You should email this question to support for an official answer, as it's been awhile since I've personally setup anything this big. What I can tell you, is I have personally setup 1200 hosts using 1 dedicated scheduler and 15 data collection nodes. I don't remember the exact specifics on CPU count, but I know nothing was over 4 cores.

[jsmith39]

Wow, I've already built close to 20 DCN's, using the 40 hosts or 750 VM's formula to determine required amounts. You manage all of those hosts from 1 search head?

[bbingham]

Yes, and you can just check the health dashboard to see how your lag is looking. Again, dedicated scheduler, I didn't use the app on the scheduler, I set that up on its own search head.