Deployment Architecture

Is it better to have higher CPU for a search head or Indexer?

robertlynch2020
Influencer

Hi

I have just received 3 new machines for a Splunk cluster.

The new machines are faster than my previous hardware. and I would like to know is it better to

Option A

Using current hardware as SH and new machines as Indexers

Option B 

Use new machine as SH and old machine + 2 new machines as Indexers

Both have the same amount of threads 56 and both have SSD

Old= Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz

3 new = Intel(R) Xeon(R) Gold 6132 CPU @ 2.60GHz

Thanks in Advance

Robert

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...