Deployment Architecture

adding search-heads to search-head pooling...

a212830
Champion

I am building out a new Splunk 6 with some new, shiny, heavy-duty servers (yay!). We are setting up search-head pooling across two servers and it got me thinking - is there any reason that, in the future (or even now) I can't add vm's to that search-head pool? They are going to be using the same NAS disk. Pro's? Con's? Seems like a nice, inexpensive way to expand search-head pooling...

Tags (1)
0 Karma

twinspop
Influencer

In my experience, VMs are poor search heads. The I/O requirements of Splunk are just too high. Additionally, SHP requires the use of an NFS share, which also slows down SH performance. Doing both is a double-whammy. Sure it works, but the performance is pretty poor. We recently got physical servers to replace our SHP'd VMs and the difference is night and day. (Even more so when I was testing them out before putting them in the SHP.)

a212830
Champion

Thanks for the info.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...