Is there a limit to how many Search Heads can be part of a Cluster?
We have a fairly large deployment and I wanted to know if there is a max limit of the amount of SH's that can be part of any one cluster.
I believe that the maximum number of members currently supported in a search-head cluster is 50.
I am not finding this documented in the expected location, so I am going to ask for this to be corrected.
By the way, just to disambiguate: Are you talking about an indexer cluster, a search-head cluster or a combination of both?
I meant Search Head Cluster but I would also be interested in the limit for an Indexer Cluster.
I don't think that we have identified a limit in the number of search-heads that can be attached to an indexer cluster. Of course, if those search-heads are going to be members of a search-head cluster, you'd want to keep that number at a maximum of 50 if you want to remain within the supported boundaries.
Hi katelynengel, I don't know if there is a theoretical limit to the amount of members in a cluster (close analysis of the raft consensus algorithm that is the foundation for the cluster might reveal that https://raft.github.io/ ), there is a practical limit based on latency between members, and the time it takes for changes to propagate.
If you have anything under a couple dozen members you should probably be fine. If you are planning on implementing a cluster of something like 50, you should let Splunk know as they will probably be very interested to hear of the results.
Let me know what you think 😄
I believe that the maximum number of members currently supported in a search-head cluster is 50.
I am not finding this documented in the expected location, so I am going to ask for this to be corrected.
Thanks! I'll pass along to my team. 🙂
Now documented here:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements
At 7.0.2, the max is 100 search heads in a cluster; Thanks @hexx