Deployment Architecture

Is it better to have higher CPU for a search head or Indexer?

robertlynch2020
Influencer

Hi

I have just received 3 new machines for a Splunk cluster.

The new machines are faster than my previous hardware. and I would like to know is it better to

Option A

Using current hardware as SH and new machines as Indexers

Option B 

Use new machine as SH and old machine + 2 new machines as Indexers

Both have the same amount of threads 56 and both have SSD

Old= Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz

3 new = Intel(R) Xeon(R) Gold 6132 CPU @ 2.60GHz

Thanks in Advance

Robert

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...