Getting Data In

Are performance improvements by splitting a single Splunk instance into one search head and one indexer on their own servers?

getahobby
New Member

Currently, I have a combined instance where the search head and indexer are sitting on the same box. The documentation does indicate that performance improvements will be made by splitting that centralized deployment into one search head and one indexer each on their own servers. (Look at the Summary of Performance Recommendations document) Is that the case? Or do you need to go to one search head with at least two different indexers? Thanks.

0 Karma

Jeremiah
Motivator

How is your current system performing? Look at your cpu, memory, and disk utilization for any constraints. Search heads tend to be cpu/memory bound and indexers tend to be i/o bound. If your current system is not running out of resources, you probably don't need to expand. According to the Performance Recommendations doc:

An indexer that meets the reference hardware requirements can ingest up to 300GB/day while supporting a search load. For a review of the current reference hardware specifications, see "Reference hardware" in this manual.

There is added complexity in managing a multi-server environment. It's not difficult, but if you don't need to switch, stick with a single server. Yes there are probably situations where running a single search head and single indexer will provide some performance advantages, but really, taking that step should be because you plan on expanding past the 300 GB/day mark and will need to add multiple indexers.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...