Solved: Different hardware in the nodes of an index cluste... - Splunk Community

Splunk Enterprise

Hi,

I have 2 indexers with different hardware specifications. Is it possible to form a cluster between these 2 nodes?

I don’t see anything about it in the documentation https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Systemrequirements

Thanks in advance,

Best regards

1 Solution

Solution

@cmorenobuitrago, technically it works but it is better to have similar specs.

- You can create an indexer cluster with 2 instances, minimum 3 instances are recommended if RF=2.

- Distributed searches will run at the speed of lower-spec hardware.

- You will also need another separate instance for Cluster Master.

If this reply helps you upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

Solution

@cmorenobuitrago, technically it works but it is better to have similar specs.

- You can create an indexer cluster with 2 instances, minimum 3 instances are recommended if RF=2.

- Distributed searches will run at the speed of lower-spec hardware.

- You will also need another separate instance for Cluster Master.

If this reply helps you upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...