Hello,
could you explain me in details the possible roles of cluster member below and what would you advice for :
2 search heads
2 indexers
1 management console (cluster master at least, deployment server & SHC deployer?)
Thanks a lot.
Hi realsplunk,
I suggest to read http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture and http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture
Anyway in Search Head cluster you have:
Note that in Search Head Cluster you must have at least 3 SHs.
In Indexer Cluster you have
Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders
Bye.
Giuseppe
Hi realsplunk,
I suggest to read http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Basicclusterarchitecture and http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCarchitecture
Anyway in Search Head cluster you have:
Note that in Search Head Cluster you must have at least 3 SHs.
In Indexer Cluster you have
Deployment Server must be a dedicated server if you have to manage more than 50 Forwarders
Bye.
Giuseppe
Thanks cusello, however why 3 SHs are required? Is there any doc on this requirement?
See http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCsystemrequirements#Required_number_o...
Anyway for a lab you can also use only two SHs!
Bye.
Giuseppe
Thank Giuseppe, we use virtual machines FYI but yes I just read 3 SHs are better in case one search head fails.