Deployment Architecture

Is there a limit to how many Search Heads can be part of a Cluster?

katelynengel
Explorer

Is there a limit to how many Search Heads can be part of a Cluster?

We have a fairly large deployment and I wanted to know if there is a max limit of the amount of SH's that can be part of any one cluster.

1 Solution

hexx
Splunk Employee
Splunk Employee

I believe that the maximum number of members currently supported in a search-head cluster is 50.

I am not finding this documented in the expected location, so I am going to ask for this to be corrected.

View solution in original post

hexx
Splunk Employee
Splunk Employee

By the way, just to disambiguate: Are you talking about an indexer cluster, a search-head cluster or a combination of both?

katelynengel
Explorer

I meant Search Head Cluster but I would also be interested in the limit for an Indexer Cluster.

0 Karma

hexx
Splunk Employee
Splunk Employee

I don't think that we have identified a limit in the number of search-heads that can be attached to an indexer cluster. Of course, if those search-heads are going to be members of a search-head cluster, you'd want to keep that number at a maximum of 50 if you want to remain within the supported boundaries.

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi katelynengel, I don't know if there is a theoretical limit to the amount of members in a cluster (close analysis of the raft consensus algorithm that is the foundation for the cluster might reveal that https://raft.github.io/ ), there is a practical limit based on latency between members, and the time it takes for changes to propagate.

If you have anything under a couple dozen members you should probably be fine. If you are planning on implementing a cluster of something like 50, you should let Splunk know as they will probably be very interested to hear of the results.

Let me know what you think 😄

hexx
Splunk Employee
Splunk Employee

I believe that the maximum number of members currently supported in a search-head cluster is 50.

I am not finding this documented in the expected location, so I am going to ask for this to be corrected.

katelynengel
Explorer

Thanks! I'll pass along to my team. 🙂

0 Karma

lguinn2
Legend

Now documented here:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

At 7.0.2, the max is 100 search heads in a cluster; Thanks @hexx

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...