Hi
I have just received 3 new machines for a Splunk cluster.
The new machines are faster than my previous hardware. and I would like to know is it better to
Option A
Using current hardware as SH and new machines as Indexers
Option B
Use new machine as SH and old machine + 2 new machines as Indexers
Both have the same amount of threads 56 and both have SSD
Old= Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz
3 new = Intel(R) Xeon(R) Gold 6132 CPU @ 2.60GHz
Thanks in Advance
Robert
Hi @robertlynch2020 ,
as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).
The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).
Ciao.
Giuseppe
Hi @robertlynch2020 ,
as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).
The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).
Ciao.
Giuseppe