2 Indexers - 12GB ram and 12 vCPU
2 Search Heads - 12GB ram and 12 vCPU
1 Heavy Forwarder/ D.S - 12GB ram and 12 vCPU
I am working on deployment with the above components and h/w specs.
Can I combine Indexer Cluster Master node with SHC Deployer and License Master ? If yes, what would be the recommended h/w specs for that ?
Regarding DMC, can I combine it with my H.F/D.S ?
Hi
Search head requires a higher CPU than indexer so ideally SH should be 16 vCPU.
You can get this info from this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Referencehardware
Splunk recommends you dedicate a host for each role but you can enable multiple server roles on a server with caveats.
Recommended hardware specs for Splunk CM,Deployer and LM depends on the factors:
Component CPU Memory Disk Network Factors
CM Med Med Low 1Gb required for indexer cluster
Deployer Low Low Low 1Gb number of SHC members
LM Low Low Low 1Gb Number of slaves
let me know if this helps!
Here's the matrix of what can go with what:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Deploy/Manageyourdeployment
And the Hardware Specs...
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Referencehardware
That being said...I'd try not to combine if you don't have to.