Deployment Architecture

Recommended search/replication factor config for 2 site index cluster w/16 indexers each

Communicator

Looking for any performance gains on our architecture and how best to take advantage of the (16) indexer clusters we have in place (1 cluster in CA, and another in midwest)

Today the replication factor = 2, and search factor = 2. Feeling like we can do better and increase performance.

Thoughts? Reasoning?

Thanks!

0 Karma

SplunkTrust
SplunkTrust

Assuming you have multi-site indexer cluster across 2 sites, what's your site search and replication factor? How many copies do you want to store in each site when a new data comes in? Look at your failover and storage considerations.

e.g. any data coming in site 1 can be stored in 2 indexers (or more if you want) in the originating site and another 2 copies in the other site. This will ensure equal amount of data in each site and fault tolerant up-to 2 nodes in a site.

Look at the examples in https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitereplicationfactor#Examples and your use cases, available storage to determine/adust Site SF/RF. Generally, distributing the copies equivally in both sites should give you a better performance. Also, if the users are across the world, you may also need to look at balancing them to both sites equally

https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Sitesearchfactor

0 Karma

Communicator

Are you facing any performance issues?
Also, what is the data volume?

0 Karma

Communicator

no performance problems persay... but something I want to understand better. Obviously looking for as-best of performance as possible out of our system. Doing roughly 4TB/day ingestion.

0 Karma

SplunkTrust
SplunkTrust

are those connected? e.g. multi-site cluster or separate indexer clusters?

0 Karma

Communicator

It is a multi-site index cluster. (16) indexers at one site and (16) indexers at another site. All managed by a single cluster master.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!