Deployment Architecture

Is it better to have higher CPU for a search head or Indexer?

Motivator

Hi

I have just received 3 new machines for a Splunk cluster.

The new machines are faster than my previous hardware. and I would like to know is it better to

Option A

Using current hardware as SH and new machines as Indexers

Option B 

Use new machine as SH and old machine + 2 new machines as Indexers

Both have the same amount of threads 56 and both have SSD

Old= Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz

3 new = Intel(R) Xeon(R) Gold 6132 CPU @ 2.60GHz

Thanks in Advance

Robert

 

Labels (1)
1 Solution

Legend

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

View solution in original post

Legend

Hi @robertlynch2020 ,

as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/Capacity/Referencehardware#:~:text=Parallelizatio... , Search Heads require more CPUs than Indexers (16 instead 12).

The most important parameter for Indexers is storage throughtput (at least 800 IOPS and more it's better).

Ciao.

Giuseppe

View solution in original post