Hardware specs for Indexer cluster Master Node and other roles it can be combined with

[damode]

2 Indexers - 12GB ram and 12 vCPU
2 Search Heads - 12GB ram and 12 vCPU
1 Heavy Forwarder/ D.S - 12GB ram and 12 vCPU

I am working on deployment with the above components and h/w specs.

Can I combine Indexer Cluster Master node with SHC Deployer and License Master ? If yes, what would be the recommended h/w specs for that ?

Regarding DMC, can I combine it with my H.F/D.S ?

[mayurr98]

Hi

Search head requires a higher CPU than indexer so ideally SH should be 16 vCPU.
You can get this info from this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Referencehardware

Splunk recommends you dedicate a host for each role but you can enable multiple server roles on a server with caveats.

Recommended hardware specs for Splunk CM,Deployer and LM depends on the factors:

Component CPU Memory Disk Network Factors
CM Med Med Low 1Gb required for indexer cluster
Deployer Low Low Low 1Gb number of SHC members
LM Low Low Low 1Gb Number of slaves

let me know if this helps!

[michael_schmidt]

Here's the matrix of what can go with what:

https://docs.splunk.com/Documentation/Splunk/7.2.3/Deploy/Manageyourdeployment

And the Hardware Specs...

https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Referencehardware

That being said...I'd try not to combine if you don't have to.