Is there a limit to how many Search Heads can be part of a Cluster?

[katelynengel]

Is there a limit to how many Search Heads can be part of a Cluster?

We have a fairly large deployment and I wanted to know if there is a max limit of the amount of SH's that can be part of any one cluster.

[hexx]

By the way, just to disambiguate: Are you talking about an indexer cluster, a search-head cluster or a combination of both?

[katelynengel]

I meant Search Head Cluster but I would also be interested in the limit for an Indexer Cluster.

[hexx]

I don't think that we have identified a limit in the number of search-heads that can be attached to an indexer cluster. Of course, if those search-heads are going to be members of a search-head cluster, you'd want to keep that number at a maximum of 50 if you want to remain within the supported boundaries.

[muebel]

Hi katelynengel, I don't know if there is a theoretical limit to the amount of members in a cluster (close analysis of the raft consensus algorithm that is the foundation for the cluster might reveal that https://raft.github.io/ ), there is a practical limit based on latency between members, and the time it takes for changes to propagate.

If you have anything under a couple dozen members you should probably be fine. If you are planning on implementing a cluster of something like 50, you should let Splunk know as they will probably be very interested to hear of the results.

Let me know what you think 😄

[hexx · Accepted solution]

I believe that the maximum number of members currently supported in a search-head cluster is 50.

I am not finding this documented in the expected location, so I am going to ask for this to be corrected.

[katelynengel]

Thanks! I'll pass along to my team. 🙂

[lguinn2]

Now documented here:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

At 7.0.2, the max is 100 search heads in a cluster; Thanks @hexx