Deployment Architecture

How can we expand our Splunk Enterprise deployment in a hardware constrained environment?

randy_moore
Path Finder

We are currently running Splunk in single instance mode and have grown enough that we need to expand it. I have the ability to provision an existing beefy server to be a second indexer. However, I do not have the hardware to have a dedicated search heard.

My reading of the splunk documentation is that I will need 3 servers minimum (1 SH, 2 IX). Is that correct? Is there no way to do "just add a second index" (management question)?

0 Karma
1 Solution

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

View solution in original post

0 Karma

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...