Getting Data In

I am moving form 1 machine to 5 machine on Splunk and i want to know what is the best way to use them?

robertlynch2020
Motivator

Hi

We are upgrading from 1 standalone machine to 5 machines. I am looking to get a cluster up and running.

Originally we were only going to use 4 and have 1 SH and 3 indexers, however, it looks like we have to have a "Master Node".

So is the best way forward 1MN, 1SH, 3 indexers?  Will The MN be used as a SH or will the machine be sitting ideal most of the time? So basically I will have 2 SH and 3 indexers?

Regards

Robert

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

robertlynch2020
Motivator

Does the CM (Assuming this is the Master node) Need to sit on a powerful machine in that case, as I have the indexers and the SH on very powerful machines?

0 Karma

soutamo
SplunkTrust
SplunkTrust

The best practices is not to use CM as a general SH. So I prefer to use your first option SH, CM and 3 IDXc in that cluster.

r. Ismo

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!