Deployment Architecture

Relationship of CPU cores between search head and indexers

responsys_cm
Builder

One thing I'm not clear on in the architecture and capacity planning guides is what the optimal relationship should be between search heads and indexers.

If I have a search head with 32 cores, should each indexer have that many as well? Or is the constraint that the limits.conf defines the max number of concurrent searches that the search head can run simultaneously, whereas the number of cores on the indexers just impacts how fast those searches can be completed?

If my four indexers have 8 cores each and the search head has 32, what happens on the indexers when the search head tries running 32 simultaneous searches? What happens if the search head overwhelms the indexers?

Thanks.

Craig

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

There is no one optimal relationship. The answer depends on the searches you are running, and the relative amount of work that can be divided between the indexers and the search head by Splunk's map-reduce framework. For example, if you run ... | stats count, almost all the work is done on the indexers, and so you can have a single search head serve many more indexers. In contrast, something like a complex ... | transaction startswith=... command will require more from the search head. If you use Verbose Mode in the timeline view, you will do things that rely more on the search head, while Fast Mode does fewer of these things.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...