Getting Data In

Distributed Indexer Hardware

ckillg
Path Finder

I'm working to purchase additional indexers, but am trying to figure out what would be the best configuration of servers.

Essentially, I can purchase one R730 with 24 hard disks in a RAID 10, or I can buy 4 R550s, each with 8 hard disks in a raid 10. Both server configs would have 2 CPUs and however much RAM I wanted (I understand the requirements are low).

I am trying to accelerate searches and provide redundancy and recovery more than trying to increase indexing rate or volume.

I can try to provide more information if needed. I've read through the sizing documentation, and I can't find any concrete recommendations for disk configuration.

Neill

0 Karma
1 Solution

Yasaswy
Contributor

Hi,

I would go the route of more indexers /servers... your data will be better distributed and will provide opportunities for faster searches. Will provide more options on clustering side as well. (More servers typically better than a single server for indexer)

From disk standpoint you can find some info here

View solution in original post

Yasaswy
Contributor

Hi,

I would go the route of more indexers /servers... your data will be better distributed and will provide opportunities for faster searches. Will provide more options on clustering side as well. (More servers typically better than a single server for indexer)

From disk standpoint you can find some info here

grijhwani
Motivator

If redundancy is what you want then the rule of not keeping all your eggs in one basket is definitely the way to go. A cluster of multiples is the far better route, and for a bonus you get easier maintainability, too. (Having the option to drop one of 4 out of the pile leaving the other 3 to take up the load in the meantime is a boon to maintenance operations.)

0 Karma

ckillg
Path Finder

Any idea if SSDs make a significant difference in search speed?

0 Karma

ckillg
Path Finder
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...