Deployment Architecture

Architecture question for Splunk Indexers

d_lim
Path Finder

As we have disk storage size budgets, would like to know which is better, 

2 IDXs with 1RF/1SF cluster, or 2 standalone indexers. We also on separate instances have 1 ES SH, 3 HFs, 1MN/DS.
 
In terms of performance, will there be any differences?
 
Thanks.
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

d_lim
Path Finder

Hi Giuseppe, thanks for your response.

My current setup is 1MN/DS and indexer, for future scalability. However there are storage budget at the moment so HA is not a requirement.

Does carrying out searches from the searchhead get delegated to the indexer via MN?

If yes, having the MN and DS role in 1 instance, the performance would be affected i believe?

0 Karma

gcusello
Esteemed Legend

Hi @d_lim,

if you don't need HA, you don't need Cluster and MN and You can configure your SH to search in the two indexers.

If you want to maintain Cluster for future HA needs, you can use the Cluster (with a dedicated MN) and configure the SH to point to the MN, so MN can answer giving the addresses of all Indexes in the cluster.

Remember that MN and Ds must be on dedicated servers!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...