Deployment Architecture

Health Check: Minimum System Requirements for Indexers

ahadghani
Engager

We are receiving messages about how our indexers (distributed environment) doesn't meet the minimum system requirements, but after taking a further look at Splunk's reference hardware documentation (https://docs.splunk.com/Documentation/Splunk/8.1.1/Capacity/Referencehardware) I still can't seem to figure out where we are lacking in. 

The message that I'm referring to is the following:

"Health Check: Splunk server "server_name" does not meet the recommended minimum system requirements."

This is currently what we're using for all three indexers:

64-bit Linux , 16 CPU cores,  and15.66 RAM. 

If anyone could provide some guidance on this matter that would be greatly appreciated! 

 

 

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ahadghani,

are you using the ES?

I found the same problem in one of my projects: Reference Hardware for Indexers with ES is 16 GM of RAM and I had 16 GB, but the health check is done on available memory that's a little less than 16 GB (in my case 15.88, in your case 15.66).

You have three solutions:

  • disabling the health check (I'd avoid!),
  • adding 1 GB of RAM ( the best if possible),
  • modify the health check search (the last choice) reducing the threeshold to 15.50.

In my project I had a physical Indexer so it wasn't possible to add RAM, so I modified the health check search.

Ciao.

Giuseppe

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on