Can Multisite SHC be integrated with Individual Indexers?

[Harishma]

We do not have Multisite SH and Indexer Cluster in our environment.
We have like really huge no of Hosts ( Indexers & SH) and many deployments, like 110 Indexers with 22 SHC , 25 Indexers with 12 SHC.

We only maintain SHC Cluster( Search heads are from two different Data centres ) and each Indexer host is a separate Instance
Can we enable multisite SHC clustering without an Indexer Cluster? - i.e Retain Indexers as separate individual hosts but enable SHC with mulitiste clustering across two sites with Individual search peers. Is this possible?

[adonio]

yes you can

see diagram and explanation here:
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture#Parts_of_a_search_head...

another way you might consider, is to cluster all your indexers with replication factor =1 and search factor = 1
that will make it easier to connect search heads to all indexers and will allow you down the road to scale if you wish to

[Harishma]

Hi @Adonio ,

I will try a POC on this.
The problem for not having indexer cluster is license cost. We ingest 100's of TB per day and the organization isnt comfortable with the license cost since a Indexer cluster has replication factor and increases license cost.

So we have do Indexers/SH from different two Data center in a single deployment.
My thought was multisite SHC cluster spread across two datacentres A & B that has search peers/Indexers from both the Data centers remain as independent Indexers.

[adonio]

hmmm, sounds odd to me, replication in a cluster doesnt cost anything but disk space. also, my recommendation was to build a cluster without replication (RF=1 SF=1). i am also having hard time believing you are ingesting "100's of TB per day" with only ~135 indexers. What is the challenge you are facing with? what is the problem you are trying to solve?

[Harishma]

Hi @adonia ,

Sorry for the late response.
We do have many indexers not just 135. Im pretty sure it must close to 200+. Many different deployments to be more precise.
Yes additional disk space is of concern as it incurs additional cost for enabling indexer cluster and thats why we just have standlone ones as of now.

We have a search head cluster with sh from both the Data centre, but it is not multisite enabled.
I would like to understand how can muliti-site SHC with standalone indexers be more advantageous in any way?
and also during disaster recovery tests will a multi-site shc add more value?