Deployment Architecture

Splunk Indexer hardware uplift: How to make best use of low end servers and high end servers?

koshyk
Super Champion

Currently our Indexers are quite old and have 32GB RAM and 12 Cores. The new servers have 256GB RAM and 32 cores. So its about 3x times powerful than the old hardware. But unfortunately, its just adding few new servers only, hence have to maintain the old inventory.
We have indexer and Search cluster with replication factor of 2 on multisite

So looking ahead, I feel the new servers and old servers will have equal data and hence equal load (search & indexing) which is NOT ideal

Is there anyway, we can make most of new powerful hardware?
- I thought of adding extra entry for Forwarders to send 2 times data to new indexers. But unfortunately, the replication factor will normalise it same across the rest of servers. So not sure, if this will provide benefit
- Parallelization settings. Can it be done on "selected servers" in a cluster?
- Any other ideas?

0 Karma

jdonn_splunk
Splunk Employee
Splunk Employee

Hi There,

I would try to keep all of the hardware in your indexing their the same. Mixing them will cause weird performance results. The same is true for a SHC.

If I were you, I'd just use the new servers in the cluster and tune the parallelization settings. I'd then use the old hardware in a SHC or SHP. You could still hold your legacy data on it if you made them searchable and pulled them out of your forwarders destination. Then just let it age out.

0 Karma

koshyk
Super Champion

I too agree, but the client is of opinion that it is not feasible to upgrade all indexers with new hardware everytime. It will be just phased out and there will be always discrepency which is fair.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...