Is there a recommended hardware configuration for Master Node?

[dvernham]

If Master Nodes don't do any indexing, is there a different configuration that is recommended for Master Nodes?    What would that configuration be?

[gcusello]

Hi @dvernham,

there isn't any explicit recommended configuration for Master Node.

It should be the standard stand alone configuration (12 CPUs and 12 GB RAM), infact if you run the Health Check of the Monitoring Console it finds a configuration warning.

I usually use a lower configuration (8 CPUs and 8 GB RAM) but I could be denied at any time because, as already mentioned, there is no reference configuration for the Master Node.

Ciao.

Giuseppe

[isoutamo]

Hi

The recommended size of CM is dependent of your environment. How many indexes, indexers, buckets etc. you have. As there are some task which don't use threads, as someone could expects,  the most important requirement is performance of one core and also memory. Unfortunately there haven't been exact proposals from Splunk side, but you could get some hints from .conf presentations.

• https://conf.splunk.com/files/2019/slides/FN1635.pdf
• https://conf.splunk.com/files/2017/slides/indexer-clustering-internals-scaling-and-performance-testi...
• Some others

r. Ismo