Deployment Architecture

Splunk Indexer hardware uplift: How to make best use of low end servers and high end servers?

Super Champion

Currently our Indexers are quite old and have 32GB RAM and 12 Cores. The new servers have 256GB RAM and 32 cores. So its about 3x times powerful than the old hardware. But unfortunately, its just adding few new servers only, hence have to maintain the old inventory.
We have indexer and Search cluster with replication factor of 2 on multisite

So looking ahead, I feel the new servers and old servers will have equal data and hence equal load (search & indexing) which is NOT ideal

Is there anyway, we can make most of new powerful hardware?
- I thought of adding extra entry for Forwarders to send 2 times data to new indexers. But unfortunately, the replication factor will normalise it same across the rest of servers. So not sure, if this will provide benefit
- Parallelization settings. Can it be done on "selected servers" in a cluster?
- Any other ideas?

0 Karma

Splunk Employee
Splunk Employee

Hi There,

I would try to keep all of the hardware in your indexing their the same. Mixing them will cause weird performance results. The same is true for a SHC.

If I were you, I'd just use the new servers in the cluster and tune the parallelization settings. I'd then use the old hardware in a SHC or SHP. You could still hold your legacy data on it if you made them searchable and pulled them out of your forwarders destination. Then just let it age out.

0 Karma

Super Champion

I too agree, but the client is of opinion that it is not feasible to upgrade all indexers with new hardware everytime. It will be just phased out and there will be always discrepency which is fair.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...