Deployment Architecture

Relationship of CPU cores between search head and indexers

responsys_cm
Builder

One thing I'm not clear on in the architecture and capacity planning guides is what the optimal relationship should be between search heads and indexers.

If I have a search head with 32 cores, should each indexer have that many as well? Or is the constraint that the limits.conf defines the max number of concurrent searches that the search head can run simultaneously, whereas the number of cores on the indexers just impacts how fast those searches can be completed?

If my four indexers have 8 cores each and the search head has 32, what happens on the indexers when the search head tries running 32 simultaneous searches? What happens if the search head overwhelms the indexers?

Thanks.

Craig

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

There is no one optimal relationship. The answer depends on the searches you are running, and the relative amount of work that can be divided between the indexers and the search head by Splunk's map-reduce framework. For example, if you run ... | stats count, almost all the work is done on the indexers, and so you can have a single search head serve many more indexers. In contrast, something like a complex ... | transaction startswith=... command will require more from the search head. If you use Verbose Mode in the timeline view, you will do things that rely more on the search head, while Fast Mode does fewer of these things.

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...