Getting Data In

Can Multisite SHC be integrated with Individual Indexers?

Harishma
Communicator

We do not have Multisite SH and Indexer Cluster in our environment.
We have like really huge no of Hosts ( Indexers & SH) and many deployments, like 110 Indexers with 22 SHC , 25 Indexers with 12 SHC.

We only maintain SHC Cluster( Search heads are from two different Data centres ) and each Indexer host is a separate Instance
Can we enable multisite SHC clustering without an Indexer Cluster? - i.e Retain Indexers as separate individual hosts but enable SHC with mulitiste clustering across two sites with Individual search peers. Is this possible?

adonio
Ultra Champion

yes you can

see diagram and explanation here:
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture#Parts_of_a_search_head...

another way you might consider, is to cluster all your indexers with replication factor =1 and search factor = 1
that will make it easier to connect search heads to all indexers and will allow you down the road to scale if you wish to

Harishma
Communicator

Hi @Adonio ,

I will try a POC on this.
The problem for not having indexer cluster is license cost. We ingest 100's of TB per day and the organization isnt comfortable with the license cost since a Indexer cluster has replication factor and increases license cost.

So we have do Indexers/SH from different two Data center in a single deployment.
My thought was multisite SHC cluster spread across two datacentres A & B that has search peers/Indexers from both the Data centers remain as independent Indexers.

0 Karma

adonio
Ultra Champion

hmmm, sounds odd to me, replication in a cluster doesnt cost anything but disk space. also, my recommendation was to build a cluster without replication (RF=1 SF=1). i am also having hard time believing you are ingesting "100's of TB per day" with only ~135 indexers. What is the challenge you are facing with? what is the problem you are trying to solve?

0 Karma

Harishma
Communicator

Hi @adonia ,

Sorry for the late response.
We do have many indexers not just 135. Im pretty sure it must close to 200+. Many different deployments to be more precise.
Yes additional disk space is of concern as it incurs additional cost for enabling indexer cluster and thats why we just have standlone ones as of now.

We have a search head cluster with sh from both the Data centre, but it is not multisite enabled.
I would like to understand how can muliti-site SHC with standalone indexers be more advantageous in any way?
and also during disaster recovery tests will a multi-site shc add more value?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>