Is it possible to have a mixed number of cores among search head cluster members?

[daniel333]

hello,

I initially built my search head cluster with 8 core VMS x10. Things are working great. 5 in our primary data center, 5 in our DR data center. I'm considering moving to hardware and was curious if I can have mixed core counts since only the primary side of my environment can have hardware, our DR site MUST remain on VMS.

That is, can I have a few 24 core blade on this side. And 12 VMs on the other side? Will Splunk be able to balance the saved search/reports/summaries/accelerations?

I'm not worried about users side, since I can configure that at the F5 load balancer relatively easy.

[jensonthottian]

If I understand your question correctly

Below is your current Config - 10 VMS with each having 8 Cores (5 primary and the other 5 as DR)

so currently your total core in primary is 5*8 =40.

What is your replication factor , concurrent search limit. How is your configuration change set - Replicated changes or Deployed changes. Does any of your search head instance/member have ad hoc only status.

You want to move to H/W which is 24 core's with 12 VMS as backup(96 cores). How many H/W in number? I think 4-5(preferred) such H/W should do the trick for you. F5 LB should deal with all other searches.