Deployment Architecture

Indexer server performance vs indexer cluster

Adpafer
Loves-to-Learn Everything

Hi Everybody,

Could you pls explain which works faster - to have 1 indexer server, high performance (48CPU, 128GB) or 2 indexers in cluster (each 24CPU, 64GB)?

 

thanks for reply.

 

regards, pawelF

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Adpafer ,

you can compare one high performance (48CPU, 128GB) indexer with two medium size (each 24CPU, 64GB) indexers without cluster, and the performaces are more or less the same.

You cannot compare one indexer with two clustered indexers because, in the second case, you have also High Availability performances that obviously you don't have with one server.

Anyway, I always hint more systems than one, even if not clustered.

Obviously clustered is better!

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

It depends.  Faster at what?  Assuming the same CPU in both cases, both will run at the same speed. When you have more than one indexer with data distributed among them, searches will be faster because of parallel processing.  This benefit works with both clustered and independent indexers.

Clustering of indexers is for data protection/redundancy rather than for speed.

There no doubt is some overhead in a cluster for replicating data, but I've not seen any data about how much that affects performance.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...