Deployment Architecture

How can we expand our Splunk Enterprise deployment in a hardware constrained environment?

randy_moore
Path Finder

We are currently running Splunk in single instance mode and have grown enough that we need to expand it. I have the ability to provision an existing beefy server to be a second indexer. However, I do not have the hardware to have a dedicated search heard.

My reading of the splunk documentation is that I will need 3 servers minimum (1 SH, 2 IX). Is that correct? Is there no way to do "just add a second index" (management question)?

0 Karma
1 Solution

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

View solution in original post

0 Karma

mwdbhyat
Builder

Have you thought of virtualizing - if the server is "beefy" you could potentially do that..It has its benefits and its drawbacks - see below https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf

You will need min 3 physical servers if you want a distributed environment, im sure you could somehow hack around this but you wouldnt get any performance gain.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...