Deployment Architecture

Can you help us scale up a distributed search from one search head + one indexer to one SH + two indexers?

xindeNokia
Path Finder

The plan is to scale up a current distributed search framework — from one search head (SH) + one indexer to one SH + two indexers.

We are not planning to use an indexer cluster, so each indexer will have different indexes.

Will the SH be smart enough to search only one indexer based on a query?

if not, I assume SH will go through all indexers for searches and return results from all of them.

Will this impact query performances?

0 Karma
1 Solution

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

View solution in original post

0 Karma

tiagofbmm
Influencer

Each Indexer just needs to be a search peer of the search head and it will distributed the search to both Indexers. No performance impact on asking for something that doesn't exist on an Indexer, you'll be fine with that.

I'd go for clustering anyway, even if with RF=SF=1 and so the cluster master wouldn't be impacting that at all and you'd be ready for future improvements. But again, you'll be fine with that Architecture too

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...