Deployment Architecture

What to do with old splunk server?

New Member

We have a single Splunk Enterprise server deployment. Recently, we migrated it to newer hardware (SSD drives, etc). The old machine is still a decent piece of equipment, just has less disk space. I've been reading about clustering, or adding an indexer. Would like to make use of the old machine for additional index storage and search, but it seems not worth doing a cluster with only two machines. Also, if I just added an indexer role, I have concerns about re-pointing forwarders there, etc. Any ideas? Anyone else been through something similar, where your older machine had not been "stolen" away and you can make use of it? Thanks in advance!

0 Karma

Path Finder

This'll vary greatly depending on your needs, your users, and your environment (especially in comparison to your volume).

First, you can't cluster two indexers without adding a third appliance, a Cluster Master, but you can still employ it as a search peer -
non-clustered indexer - to balance the load.

A couple other ideas...

  • Offload smaller roles, like License Manager or Deployment Server, onto it.
  • Create a dedicated DMC
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!