Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment?

[horsefez]

Hi,

I'm planning on deploying a Splunk infrastructure.

I'm currently undecided whether I should build the infrastructure according to the following configurations.

1. Multisite-Cluster hosted across two data centers with one ESX Server each
2. Bare Metal Virtualization
3. 1 Master Node residing on only one of the data centers

4. 1 Search Head for each data center (hosted on ESX)

5. 1 Indexer for each datacenter (hosted on ESX)
   OR

6. 2 Indexers for each datacenter (hosted on ESX)

With 1 indexer on each site, I planned to have a replication factor of 2 and a search factor of 2 and a site-rep-factor of 1.
With 2 indexers on each site a replication factor of 4 and a search factor of 3 and a site-rep-factor of 2.

Is it advisable to host 2 smaller indexers instead of one big indexer?
Are there performance benefits or caveats?

Regards,
pyro_wood

[lguinn2 · Accepted solution]

Multi-site clustering requires at least 2 indexers per site. Both of them must meet Splunk's minimum requirements.

[horsefez]

Thank you, I didn't take this into consideration

[jbrocks]

I think you could also have a multi site cluster with one site and one indexer