Getting Data In

Can a hardware and a software indexer(virtual indexer) be clustered?


As the title suggests, is it possible to do that? logically it seems possible but I am not sure what performance impact it would have on the functioning of the cluster.

Hence, please suggest if this is possible and any points that should be taken into consideration.

Thank you.

0 Karma

Ultra Champion

hello there,

please read here:
to your question, is ti possible? yes it is possible, everything (almost) is possible.
is it supportable? arguably if you have the same OS and splunk version
is it recommended? not very much, VMs tend to be weaker (if they have same specs) than physical machines, also, shared storage and maybe shared network can become bottlenecks for performance.
lastly, when you have more than 1 indexer (clustered or not) and a search head that searches against them, the performance is as strong as the weakest indexer.
it is highly recommended (only because i couldnt find in docs a statement that says: "cant do VM and physical with same specs")almost to a required degree that all your indexers will be exactly the same, specialty when clustered

hope it helps

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...