Deployment Architecture

Are multi-instances on one machine supported for index replication?

sunrise
Contributor

I think a cluster configuration of Splunk.
Considering of Indexer redundancy, the cluster configuration needs at least 4 splunk instances,
master node, two peers, search head (replication factor=2).

We are not always able to get enough environments (one instance on one machine).

So I think multi splunk intances on one machine.
Is it supported ?
And are there any supported installing procedures ?

(I confirmed that Splunk is able to introduce to nix more than once with a force option in RPM.
And according to below URL, maybe we can do that in Windows system.

Community:Run multiple Splunks on one machine - Splunk Wiki http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine )

Thank you.

1 Solution

yannK
Splunk Employee
Splunk Employee

As a first remark, having 2 indexers with replication on the same hardware beats the purpose of the replication.
So you should at least have one machine per indexer.

Second remark : The master cannot do double duty as a peer node or a search head, and it cannot reside on the same machine as a peer node or search head. see http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Basicclusterarchitecture#Master_node

However you can run a search-head on the same machine than an indexer, or even turn the indexer into a search-head. But this will impact your indexing and search performance.

To run several instances on the same linux box, install in 2 different locations and edit the web.conf to specify different management ports and different web ports. To run several instance on windows, I still have doubts on this. ( and in general splunk indexer performance are slightly better on linux anyway)

View solution in original post

yannK
Splunk Employee
Splunk Employee

As a first remark, having 2 indexers with replication on the same hardware beats the purpose of the replication.
So you should at least have one machine per indexer.

Second remark : The master cannot do double duty as a peer node or a search head, and it cannot reside on the same machine as a peer node or search head. see http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Basicclusterarchitecture#Master_node

However you can run a search-head on the same machine than an indexer, or even turn the indexer into a search-head. But this will impact your indexing and search performance.

To run several instances on the same linux box, install in 2 different locations and edit the web.conf to specify different management ports and different web ports. To run several instance on windows, I still have doubts on this. ( and in general splunk indexer performance are slightly better on linux anyway)

sunrise
Contributor

Actually, we can reside multi instances on the same machine by changing install directory (eg. rpm --force -ihv --prefix=/opt/(splunk instance) (splunk media).rpm).

But it may be not recommended to coexist peers because of its performance, and master node which is not supported for the double duty.

0 Karma

ephemeric
Contributor

Cannot reside on the same machine? Not even as a separate instance? How would it know anyway?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...