Splunk Enterprise

We have Two indexer clusters managed by there own cluster master and a single SH cluster - would it cause Performance Degradation while indexing and retrieval of data to the users during the indexing of high volume data ?

bhavesh91
New Member

We have Two indexer clusters managed by there own cluster master and a single SH cluster - would it cause Performance Degradation while indexing and retrieval of data to the users during the indexing of high volume data ?
The cluster masters are on Cloud Infrastructure with 4 vCPU , 1 set of indexer cluster consists of physicals and the other set consists of VM wares . We have started seeing that the CPU load on indexers in physicals have been creeping high , so could you guys help in understanding whether is it due to the addition of a new cluster or is it something else ?

Tags (1)
0 Karma

sloshburch
Splunk Employee
Splunk Employee

I'm having trouble understanding the question. It sounds like you are having performance issues and asking if a very specific part of your architecture is the root cause. I would suggest opening a support ticket. If you have performance issues it could be anything from disk IO to sourcetype configuration and support would be well positioned to help investigate.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Having two indexer clusters doesn't cause high load on the indexer clusters. In most cases, the majority of load on indexers is caused by searches running on them.
Hard to say for your particular case without knowing anything about your particular case.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>