Deployment Architecture

Can you help us scale up a distributed search from one search head + one indexer to one SH + two indexers?

xindeNokia
Path Finder

The plan is to scale up a current distributed search framework — from one search head (SH) + one indexer to one SH + two indexers.

We are not planning to use an indexer cluster, so each indexer will have different indexes.

Will the SH be smart enough to search only one indexer based on a query?

if not, I assume SH will go through all indexers for searches and return results from all of them.

Will this impact query performances?

0 Karma
1 Solution

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

View solution in original post

0 Karma

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...