Deployment Architecture

Architecture question for Splunk Indexers

d_lim
Path Finder

As we have disk storage size budgets, would like to know which is better, 

2 IDXs with 1RF/1SF cluster, or 2 standalone indexers. We also on separate instances have 1 ES SH, 3 HFs, 1MN/DS.
 
In terms of performance, will there be any differences?
 
Thanks.
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

d_lim
Path Finder

Hi Giuseppe, thanks for your response.

My current setup is 1MN/DS and indexer, for future scalability. However there are storage budget at the moment so HA is not a requirement.

Does carrying out searches from the searchhead get delegated to the indexer via MN?

If yes, having the MN and DS role in 1 instance, the performance would be affected i believe?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @d_lim,

if you don't need HA, you don't need Cluster and MN and You can configure your SH to search in the two indexers.

If you want to maintain Cluster for future HA needs, you can use the Cluster (with a dedicated MN) and configure the SH to point to the MN, so MN can answer giving the addresses of all Indexes in the cluster.

Remember that MN and Ds must be on dedicated servers!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...