Splunk Indexer hardware uplift: How to make best use of low end servers and high end servers?

[koshyk]

Currently our Indexers are quite old and have 32GB RAM and 12 Cores. The new servers have 256GB RAM and 32 cores. So its about 3x times powerful than the old hardware. But unfortunately, its just adding few new servers only, hence have to maintain the old inventory.
We have indexer and Search cluster with replication factor of 2 on multisite

So looking ahead, I feel the new servers and old servers will have equal data and hence equal load (search & indexing) which is NOT ideal

Is there anyway, we can make most of new powerful hardware?
- I thought of adding extra entry for Forwarders to send 2 times data to new indexers. But unfortunately, the replication factor will normalise it same across the rest of servers. So not sure, if this will provide benefit
- Parallelization settings. Can it be done on "selected servers" in a cluster?
- Any other ideas?

[jdonn_splunk]

Hi There,

I would try to keep all of the hardware in your indexing their the same. Mixing them will cause weird performance results. The same is true for a SHC.

If I were you, I'd just use the new servers in the cluster and tune the parallelization settings. I'd then use the old hardware in a SHC or SHP. You could still hold your legacy data on it if you made them searchable and pulled them out of your forwarders destination. Then just let it age out.

[koshyk]

I too agree, but the client is of opinion that it is not feasible to upgrade all indexers with new hardware everytime. It will be just phased out and there will be always discrepency which is fair.