Can I use the same indexers for a Splunk Enterprise search head and another search head?

[shubham87]

I am in process of Splunk Enterprise Security deployment. While deployment of Add-ons to my indexers, documentation says:

"Splunk Enterprise Security is running on a complex deployment, such as one Enterprise Security search head and one search head for other searches both using the same set of indexers"
"Contact Splunk Professional Services for assistance with deploying add-ons to your indexers."

What are issues while using same set of indexers for ES-Search Head and other Search Head? Anyone have documentation to successfully deploy same?

Regards
Shubham

[ltrand]

Here is generally the reason behind this guidance:

From a supportability perspective, for both the admin and the customer, it's easier to have ES, which is very complex, to be on its own and not have other apps or TA's conflict with what ES expects.

That said, at the end of the day your indexers need to be large enough to support the total amount of search, regardless of the number of search heads, search head clusters, etc that will be utilized. So as an admin, you need to ensure your monitoring the indexers load and size them for the total expected concurrency.

[smoir_splunk]

@shubham87, the main concern is big enough indexers to support the added search load from 2 search heads. Having ES adds a significant search load to your indexers, and a second search head pointing to the same one can increase that even more. As long as your indexers can support the added search load, you should be okay.
See the indexer scaling recommendations here: http://docs.splunk.com/Documentation/ES/4.7.2/Install/DeploymentPlanning#Indexer_scaling_considerati...

[shubham87]

Is this the only concern? Is there anything else that we need to take care of?