Deployment Architecture

Can you help us scale up a distributed search from one search head + one indexer to one SH + two indexers?

xindeNokia
Path Finder

The plan is to scale up a current distributed search framework — from one search head (SH) + one indexer to one SH + two indexers.

We are not planning to use an indexer cluster, so each indexer will have different indexes.

Will the SH be smart enough to search only one indexer based on a query?

if not, I assume SH will go through all indexers for searches and return results from all of them.

Will this impact query performances?

0 Karma
1 Solution

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

View solution in original post

0 Karma

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...