Getting Data In

Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

SplunkTrust
SplunkTrust

Hi,

I'm planning on deploying a Splunk infrastructure.

I'm currently undecided whether I should build the infrastructure according to the following configurations.

  1. Multisite-Cluster hosted across two data centers with one ESX Server each
  2. Bare Metal Virtualization
  3. 1 Master Node residing on only one of the data centers
  4. 1 Search Head for each data center (hosted on ESX)

  5. 1 Indexer for each datacenter (hosted on ESX)
    OR

  6. 2 Indexers for each datacenter (hosted on ESX)

With 1 indexer on each site, I planned to have a replication factor of 2 and a search factor of 2 and a site-rep-factor of 1.
With 2 indexers on each site a replication factor of 4 and a search factor of 3 and a site-rep-factor of 2.

Is it advisable to host 2 smaller indexers instead of one big indexer?
Are there performance benefits or caveats?

Regards,
pyro_wood

0 Karma
1 Solution

Legend

Multi-site clustering requires at least 2 indexers per site. Both of them must meet Splunk's minimum requirements.

View solution in original post

0 Karma

Legend

Multi-site clustering requires at least 2 indexers per site. Both of them must meet Splunk's minimum requirements.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Thank you, I didn't take this into consideration

0 Karma

Communicator

I think you could also have a multi site cluster with one site and one indexer

0 Karma