Deployment Architecture

Is it possible to have a mixed number of cores among search head cluster members?

daniel333
Builder

hello,

I initially built my search head cluster with 8 core VMS x10. Things are working great. 5 in our primary data center, 5 in our DR data center. I'm considering moving to hardware and was curious if I can have mixed core counts since only the primary side of my environment can have hardware, our DR site MUST remain on VMS.

That is, can I have a few 24 core blade on this side. And 12 VMs on the other side? Will Splunk be able to balance the saved search/reports/summaries/accelerations?

I'm not worried about users side, since I can configure that at the F5 load balancer relatively easy.

0 Karma

jensonthottian
Contributor

If I understand your question correctly

Below is your current Config - 10 VMS with each having 8 Cores (5 primary and the other 5 as DR)

so currently your total core in primary is 5*8 =40.

What is your replication factor , concurrent search limit. How is your configuration change set - Replicated changes or Deployed changes. Does any of your search head instance/member have ad hoc only status.

You want to move to H/W which is 24 core's with 12 VMS as backup(96 cores). How many H/W in number? I think 4-5(preferred) such H/W should do the trick for you. F5 LB should deal with all other searches.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...