Getting Data In

Should I build out a cluster master with the same hardware spec requirements as my heavy forwarder?

sbattista09
Contributor

Should I build out a cluster master with the same hardware requirements as my heavy forwarder?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Our cluster master and deployment servers were sharing a VM with the following specs until very recently: 4 cores, 4 GB RAM, 50GB dedicated drive. We had 2000 UFs and 6 indexers.

The minimum spec I would go for nowadays is the following:

  • Intel 64-bit chip architecture, 2 cores, 2 GHz
  • 2GB RAM
  • OS installation + 50GB free
  • Standard 1Gb Ethernet NIC, with optional second NIC for a management network
  • Linux 3.x 64-bit edition

If you can afford it get 4 cores and 4GB RAM.

Hope that helps.

Regards,
Javier

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Our cluster master and deployment servers were sharing a VM with the following specs until very recently: 4 cores, 4 GB RAM, 50GB dedicated drive. We had 2000 UFs and 6 indexers.

The minimum spec I would go for nowadays is the following:

  • Intel 64-bit chip architecture, 2 cores, 2 GHz
  • 2GB RAM
  • OS installation + 50GB free
  • Standard 1Gb Ethernet NIC, with optional second NIC for a management network
  • Linux 3.x 64-bit edition

If you can afford it get 4 cores and 4GB RAM.

Hope that helps.

Regards,
Javier

hagjos43
Contributor

That's not enough information to go on with 100% accuracy. BUT, let me tell you about our environment and maybe that'll help.

We have two indexers, one searchhead, a handful of heavy forwarders, and hundreds of universal forwarders. When we moved to the two indexer model we just lumped our cluster master in with our deployment server and have had zero issues in over 6-7 months.

Hope that helps!

0 Karma

sbattista09
Contributor

glad to hear! we have 4 indexers and about 800 to 1000 UF's. Im looking for a guild line to spec out a Cluster master.

0 Karma

hagjos43
Contributor

Ours is a VM:
4 cores, 6 GB of RAM, around 100GB of storage to start (being a VM we can grow it as needed).

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...