Deployment Architecture

Is it possible to have a mixed number of cores among search head cluster members?

daniel333
Builder

hello,

I initially built my search head cluster with 8 core VMS x10. Things are working great. 5 in our primary data center, 5 in our DR data center. I'm considering moving to hardware and was curious if I can have mixed core counts since only the primary side of my environment can have hardware, our DR site MUST remain on VMS.

That is, can I have a few 24 core blade on this side. And 12 VMs on the other side? Will Splunk be able to balance the saved search/reports/summaries/accelerations?

I'm not worried about users side, since I can configure that at the F5 load balancer relatively easy.

0 Karma

jensonthottian
Contributor

If I understand your question correctly

Below is your current Config - 10 VMS with each having 8 Cores (5 primary and the other 5 as DR)

so currently your total core in primary is 5*8 =40.

What is your replication factor , concurrent search limit. How is your configuration change set - Replicated changes or Deployed changes. Does any of your search head instance/member have ad hoc only status.

You want to move to H/W which is 24 core's with 12 VMS as backup(96 cores). How many H/W in number? I think 4-5(preferred) such H/W should do the trick for you. F5 LB should deal with all other searches.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...