I am moving form 1 machine to 5 machine on Splunk and i want to know what is the best way to use them?

[robertlynch2020]

Hi

We are upgrading from 1 standalone machine to 5 machines. I am looking to get a cluster up and running.

Originally we were only going to use 4 and have 1 SH and 3 indexers, however, it looks like we have to have a "Master Node".

So is the best way forward 1MN, 1SH, 3 indexers?  Will The MN be used as a SH or will the machine be sitting ideal most of the time? So basically I will have 2 SH and 3 indexers?

Regards

Robert

[richgalloway · Accepted solution]

If you want in indexer cluster then you must have an instance to serve as the Master Node.  The same instance can also serve as your License Master (also a requirement).

I suggest keeping the existing instance as one of the indexers.  That will keep you from having to move a lot of data. 

Designate one of the new machines as the new search head and move user data from the current instance.  Copy the installed apps from the old instance to the new SH.

If you're running Splunk DB Connect then you'll also want an instance to serve as a heavy forwarder which will run DBX.

See https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Migratenon-clusteredindexerstoaclusterede... for more information.

[robertlynch2020]

Does the CM (Assuming this is the Master node) Need to sit on a powerful machine in that case, as I have the indexers and the SH on very powerful machines?

[isoutamo]

The best practices is not to use CM as a general SH. So I prefer to use your first option SH, CM and 3 IDXc in that cluster.

r. Ismo