Deployment Architecture

Can you help us scale up a distributed search from one search head + one indexer to one SH + two indexers?

xindeNokia
Path Finder

The plan is to scale up a current distributed search framework — from one search head (SH) + one indexer to one SH + two indexers.

We are not planning to use an indexer cluster, so each indexer will have different indexes.

Will the SH be smart enough to search only one indexer based on a query?

if not, I assume SH will go through all indexers for searches and return results from all of them.

Will this impact query performances?

0 Karma
1 Solution

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

View solution in original post

0 Karma

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...