Deployment Architecture

Splunk server roles

Builder

Hello,

could you explain me in details the possible roles of cluster member below and what would you advice for :

2 search heads
2 indexers
1 management console (cluster master at least, deployment server & SHC deployer?)

alt text

Thanks a lot.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi realsplunk,
I suggest to read http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture and http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture

Anyway in Search Head cluster you have:

  • Search Head Captain
  • Search Heads
  • Deployer: manage replication between SHs

Note that in Search Head Cluster you must have at least 3 SHs.

In Indexer Cluster you have

  • Search Peers (at least 2)
  • Master Node

Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

Hi realsplunk,
I suggest to read http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture and http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture

Anyway in Search Head cluster you have:

  • Search Head Captain
  • Search Heads
  • Deployer: manage replication between SHs

Note that in Search Head Cluster you must have at least 3 SHs.

In Indexer Cluster you have

  • Search Peers (at least 2)
  • Master Node

Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders

Bye.
Giuseppe

View solution in original post

Builder

Thanks cusello, however why 3 SHs are required? Is there any doc on this requirement?

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Builder

Thank Giuseppe, we use virtual machines FYI but yes I just read 3 SHs are better in case one search head fails.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!