Deployment Architecture

If we have a single indexer, is there any advantage to have a separate search head?

di2esysadmin
Path Finder

Would searches be faster if we put our single indexer on one host and a single search head on another?

I see the simple architecture for multiple indexers and a single search head. But we really don't need more than one indexer.

I'm not convinced there is any gain in splitting the indexer and search functions across two hosts.

Appreciate guidance.

Karla

Tags (1)
0 Karma
1 Solution

BenjaminWyatt
Communicator

General Splunk guidelines state there isn't much benefit to splitting out the search head/indexer functions into separate servers until you have about 4 indexers. You should be fine as you are.

View solution in original post

0 Karma

BenjaminWyatt
Communicator

General Splunk guidelines state there isn't much benefit to splitting out the search head/indexer functions into separate servers until you have about 4 indexers. You should be fine as you are.

0 Karma

di2esysadmin
Path Finder

As I suspected. THANKS!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...