Splunk Search

Migrating from a single indexer to dual indexer clustering, which of these options will be the best for search performance?

rameshlpatel
Communicator

Hi,

I am planning to migrate from my single indexer to dual indexer clustering. Here we have two ways to do that:

1) Ask the forwarder to switch between two indexers in 30 seconds. Search Head will merge data from two indexers.

2) Distribute indexes in two indexers like index=OCSPROD in server1 and index=EBIZPROD in server-2. Configure forwarder to send logs to a specific indexer without switching between two.

Here my question is, which would be the best performance wise for search & reporting?

0 Karma
1 Solution

jnussbaum_splun
Splunk Employee
Splunk Employee

Are these two indexers going to be located at the same site? Would assuming same latency be correct?

If so - You'll want the forwarder to load balance between your two indexers, so when searching you can leverage distributed search against the two peers for best performance.

View solution in original post

jnussbaum_splun
Splunk Employee
Splunk Employee

Are these two indexers going to be located at the same site? Would assuming same latency be correct?

If so - You'll want the forwarder to load balance between your two indexers, so when searching you can leverage distributed search against the two peers for best performance.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...