Deployment Architecture

best use of "spare" servers

a212830
Champion

Hi,

We upgraded to Splunk 6.1 this spring, and with that purchased new physical servers. The SH's (two) are 64 cores and 128gb of memory and the indexers are all 48 cores and 128gb of memory. I have two additional servers - one of the original servers (16 cores and 48gb of memory) and another new one that is 32 cores and 128gb of memory. I want to put these to use before I'm told to return them. However, since they don't match the specs of either of the existing SH's or indexers, I've been told (unofficially) that it's not a great idea - the servers should all be the same specs within function. Do people agree with this? Is there any reason that I couldn't make both of these either indexers or SH's? (I do plan on upgrading to 6.2 early next year).

0 Karma

ekost
Splunk Employee
Splunk Employee

Sweet. Run D.M.C. after upgrading to 6.2. And I'm sure you'll want a deployer node for the search head cluster.

martin_mueller
SplunkTrust
SplunkTrust

More uses would be as a master in an indexer cluster, as a heavy forwarder for "special needs" sources such as DBConnect, a testbed for crazy new ideas, ...

I doubt you'll need a deployer though, because running a search head cluster with just two SHs shouldn't really work... however, you could use one of the spare boxes as a dedicated captain captain_is_adhoc_searchhead = true and turn your two SHs into a working search head cluster 😄

a212830
Champion

Ideally, I'd like to add it to the SHC. Sounds like I could use it as the captain, and still have it perform searches? I'd like to take advantage of the number of cores and memory available on the 32 core server especially. For the other uses, I'm able to spin up smaller servers quickly.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...