Splunk cluster

[498773]

Please suggest the best practise for splunk deployment

Considerations:

• Index data of size 2GB daily
• Data comes from 20 different hosts
• Report generation on data

Proposed Solution:

• Search Factor=2, Replication Factor=2

• 20 forwarders to pull data from hosts

• One master node, Two Peer Nodes(for Indexing) , One Search head

• Data on each node would be 1GB (considering RF and SF)

My question is does this set up looks good or can i avoid search head as there are only two indexers, please suggest some best practices . Do i really need to go for cluster set up if not what can be done ?????

looking forward for your ideas, Thanks in advance

[kristian_kolb · Accepted solution]

No, you don't need to have a cluster. It's a design decision which will give you added fault tolerance. Given the rather small amount of data you're indexing, a single server will most likely satisfy your capacity needs (depending on the amount of searches you will actually be making - scheduled or manual).

NB: with a cluster like you specified, the storage on each node will be 2GB daily, not 1GB, since you duplicate all your data (SF=2, RF=2). Thus it's 4GB spread over 2 indexers.

/K

[498773]

Thanks kristian