Architecture question for Splunk Indexers

[d_lim]

As we have disk storage size budgets, would like to know which is better, 

2 IDXs with 1RF/1SF cluster, or 2 standalone indexers. We also on separate instances have 1 ES SH, 3 HFs, 1MN/DS.

In terms of performance, will there be any differences?

Thanks.

[gcusello · Accepted solution]

Hi @d_lim,

There isn't a great performance difference between Clustered and not clustered Indexers, obviously in Clustered, Splunk must manage alignments and this gives a little overload than not clustered, but I think that performaces isn't the real question in this case: do you need HA or not?

If you need HA, the only choice is Clustered; if you don't need HA not clustered it's better because clustered Indexers require double storage than not clustered.

In addition not clustered indexers don't require MN.

Then I don't understand why you have a cluster with 1 RF 1SF, in other words you have a cluster without HA; probably you don't need HA!

At least, it's a best practice to have a dedicated Master Node (at most also License Master), and a dedicated Deployment Server (if it has to manage more than 50 clients).

Anyway, the Splunk Architecture design isn't a problem to solve with some answer in Community, I hint to call a Splunk Architect to review your Architecture.

Ciao.

Giuseppe

[d_lim]

Hi Giuseppe, thanks for your response.

My current setup is 1MN/DS and indexer, for future scalability. However there are storage budget at the moment so HA is not a requirement.

Does carrying out searches from the searchhead get delegated to the indexer via MN?

If yes, having the MN and DS role in 1 instance, the performance would be affected i believe?

[gcusello]

Hi @d_lim,

if you don't need HA, you don't need Cluster and MN and You can configure your SH to search in the two indexers.

If you want to maintain Cluster for future HA needs, you can use the Cluster (with a dedicated MN) and configure the SH to point to the MN, so MN can answer giving the addresses of all Indexes in the cluster.

Remember that MN and Ds must be on dedicated servers!

Ciao.

Giuseppe