Splunk Distributed Deployment: Best Practisce

[AliMaher]

Hello,

I am writing to ask from which point regarding the EPS OR Daily ingested GB/day and the number of users simultaneously access the search head.

at what point should i consider a cluster search head cluster, as it will be (one-single SH ) OR (three SH + Deployer)?

from your technical perspective?

[gcusello]

Hi @AliMaher ,

as also @PickleRick and @richgalloway said, the correct reference hardware and the number of SHs depends not only on the number of active users but mainly on the number of searches that you have in your infrastructure, with special attention to scheduled searches.

In addition it depends also on the presence of Premium Apps like Enterprise Security or ITSI that use many scheduled searches.

You can monitor the load on the SH using the Monitoring Console: if the load on the SH is too high, you can think to add another SH or increase the reference hardware (CPUs).

The use of a Cluster depends on if you have the requirement of HA or not, not on the load on SH.

In addition, when you monitor the performances of your infrastructure, remember to monitor also the load on Indexers because all the searches from SHs arrive on Indexers: you can monitor Indexers performaces using still the Monitoring Console.

Anyway, the best approach is to analyze the requirements, in terms di indexed logs, scheduled searces,  active users and presence of Premium Apps with a Splunk Architect that can design the best architecture for your infrastructure.

Ciao.

Giuseppe

[PickleRick]

There is no single answer to a general sizing question. All general guidelines may not apply in your specific use case.

Typically you scale search head layer out horizontally when you have either many users who work on your environment simultaneously and you want to spread the load across many nodes or you have many saved searches so that your scheduler can distribute the search activity across SHC nodes. Just remember that SHC does _not_ help you with a single search performance and it does _not_ help you for a single user session - those are always limited by single SH parameters and load.

[AliMaher]

Thanks!

Could you elaborate more on EPS OR GB/Day?

[richgalloway]

Neither is relevant.  Ingest rate applies to indexers, not search heads.

[richgalloway]

When the biggest server available to you isn't enough for the search load then it's time for a SHC.