Deployment Architecture

Indexer server performance vs indexer cluster

Adpafer
Loves-to-Learn Everything

Hi Everybody,

Could you pls explain which works faster - to have 1 indexer server, high performance (48CPU, 128GB) or 2 indexers in cluster (each 24CPU, 64GB)?

 

thanks for reply.

 

regards, pawelF

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Adpafer ,

you can compare one high performance (48CPU, 128GB) indexer with two medium size (each 24CPU, 64GB) indexers without cluster, and the performaces are more or less the same.

You cannot compare one indexer with two clustered indexers because, in the second case, you have also High Availability performances that obviously you don't have with one server.

Anyway, I always hint more systems than one, even if not clustered.

Obviously clustered is better!

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

It depends.  Faster at what?  Assuming the same CPU in both cases, both will run at the same speed. When you have more than one indexer with data distributed among them, searches will be faster because of parallel processing.  This benefit works with both clustered and independent indexers.

Clustering of indexers is for data protection/redundancy rather than for speed.

There no doubt is some overhead in a cluster for replicating data, but I've not seen any data about how much that affects performance.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...