Deployment Architecture

sizing of master node in cluster? is it same as peer nodes

ajaysamantbms
Explorer

i am about to define hardware configuration for setting up splunk cluster on AWS.

I know peer nodes have to be high I/O, and data resides on peer nodes so ebs size should be enough to handle replication and search factor.

What about master node that handles cluster?
Does it also need to be high IO or high cpu or high memory?

Whats a typical hardware requirement of master node in a 2 Search Head + 2 Search Peer configuration.

I am planning to have 6 instances on AWS . 2 for Search Heads + 2 For Search Peers + 1 Deployment Server + 1 Master Node... I dont know what to select for Master Node...- m2 large, m2 extra large , etc..

Tags (1)
0 Karma
1 Solution

ckurtz
Path Finder

The master node stores no data and just acts as a "traffic cop" for the cluster peers, and does not need to be anything special machine-wise. I run 7 indexers at 500gb/day with a master node that is a Virtual Machine with 4 CPUs and 4gb of memory. The master node never has any load.

View solution in original post

0 Karma

ckurtz
Path Finder

The master node stores no data and just acts as a "traffic cop" for the cluster peers, and does not need to be anything special machine-wise. I run 7 indexers at 500gb/day with a master node that is a Virtual Machine with 4 CPUs and 4gb of memory. The master node never has any load.

0 Karma

ASealey_Nike
Engager

Here is a link the specifications for running Splunk on AWS

As far as the master node, it does not need the high IO that the peers do, because it doesn't actually index any data. I run a quad core with 12G RAM for a master node also serving as a license server, with no issues.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...