Deployment Architecture
Highlighted

If a search head cluster is deployed in multi-site, what type of storage is required for each search head?

Contributor

If a search head cluster is deployed in multiple sites (2 sites), what is the type of storage is required for each search head? Local storage is fine or do we have to use SAN storage?

0 Karma
Highlighted

Re: If a search head cluster is deployed in multi-site, what type of storage is required for each search head?

Splunk Employee
Splunk Employee

The requirements don't change compared to an intra-DC SHC; local storage is fine. SHC members do not share resources amongst each other. The documentation here and here should answer your questions.

You need to ensure that your network latency is low (we have tested SHC up to 300ms), and that the SHC members can communicate with each other on the configured replication ports.

Highlighted

Re: If a search head cluster is deployed in multi-site, what type of storage is required for each search head?

Influencer

I would also add: Make sure that the SHC members' times are synchronized as well.

0 Karma
Highlighted

Re: If a search head cluster is deployed in multi-site, what type of storage is required for each search head?

Splunk Employee
Splunk Employee

@ankithreddy777 - Did the answer provided by ssievert help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma