Deployment Architecture

How can we expand our Splunk Enterprise deployment in a hardware constrained environment?

randy_moore
Path Finder

We are currently running Splunk in single instance mode and have grown enough that we need to expand it. I have the ability to provision an existing beefy server to be a second indexer. However, I do not have the hardware to have a dedicated search heard.

My reading of the splunk documentation is that I will need 3 servers minimum (1 SH, 2 IX). Is that correct? Is there no way to do "just add a second index" (management question)?

0 Karma
1 Solution

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

View solution in original post

0 Karma

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...