Deployment Architecture

Architecture question for Splunk Indexers

d_lim
Path Finder

As we have disk storage size budgets, would like to know which is better, 

2 IDXs with 1RF/1SF cluster, or 2 standalone indexers. We also on separate instances have 1 ES SH, 3 HFs, 1MN/DS.
 
In terms of performance, will there be any differences?
 
Thanks.
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

d_lim
Path Finder

Hi Giuseppe, thanks for your response.

My current setup is 1MN/DS and indexer, for future scalability. However there are storage budget at the moment so HA is not a requirement.

Does carrying out searches from the searchhead get delegated to the indexer via MN?

If yes, having the MN and DS role in 1 instance, the performance would be affected i believe?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

if you don't need HA, you don't need Cluster and MN and You can configure your SH to search in the two indexers.

If you want to maintain Cluster for future HA needs, you can use the Cluster (with a dedicated MN) and configure the SH to point to the MN, so MN can answer giving the addresses of all Indexes in the cluster.

Remember that MN and Ds must be on dedicated servers!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...