Deployment Architecture

How can we expand our Splunk Enterprise deployment in a hardware constrained environment?

randy_moore
Path Finder

We are currently running Splunk in single instance mode and have grown enough that we need to expand it. I have the ability to provision an existing beefy server to be a second indexer. However, I do not have the hardware to have a dedicated search heard.

My reading of the splunk documentation is that I will need 3 servers minimum (1 SH, 2 IX). Is that correct? Is there no way to do "just add a second index" (management question)?

0 Karma
1 Solution

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

View solution in original post

0 Karma

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

0 Karma
Get Updates on the Splunk Community!

REST API Endoint to create correlation search

Hello, Is it possible to create correlation search in splunk ES app using REST API?

Does Splunk SOAR support mTLS

In the context of connecting Splunk Cloud and Phantom. Does Phantom/Splunk SOAR support mTLS?

Should our Deployment Servers have the Search Head server role on them?

all of our stuff is on premcurrently our dedicated Deployment Servers also have the Search Head role on them, ...