Splunk Search

Migrating from a single indexer to dual indexer clustering, which of these options will be the best for search performance?

rameshlpatel
Communicator

Hi,

I am planning to migrate from my single indexer to dual indexer clustering. Here we have two ways to do that:

1) Ask the forwarder to switch between two indexers in 30 seconds. Search Head will merge data from two indexers.

2) Distribute indexes in two indexers like index=OCSPROD in server1 and index=EBIZPROD in server-2. Configure forwarder to send logs to a specific indexer without switching between two.

Here my question is, which would be the best performance wise for search & reporting?

0 Karma
1 Solution

jnussbaum_splun
Splunk Employee
Splunk Employee

Are these two indexers going to be located at the same site? Would assuming same latency be correct?

If so - You'll want the forwarder to load balance between your two indexers, so when searching you can leverage distributed search against the two peers for best performance.

View solution in original post

jnussbaum_splun
Splunk Employee
Splunk Employee

Are these two indexers going to be located at the same site? Would assuming same latency be correct?

If so - You'll want the forwarder to load balance between your two indexers, so when searching you can leverage distributed search against the two peers for best performance.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...