Splunk Search

Does more indexers contribute to the performance of search on search head?

nickcode
Explorer

Does more indexers contribute to the performance of search on search head?
I found when i launch a search in the search head, every time there is only one indexer in my indexers group running
. And the event scanning speed is not faster than all the things done within a single splunk instance.
I wonder if the more indexers there are, the faster search speed it is?

0 Karma

yannK
Splunk Employee
Splunk Employee

YES.
More indexers, means that the events are balanced between multiple instances, each of them will have a less data to search over, and it will be parallelized.

Make sure that your forwarder are loadbalancing between your indexers.
You can verify why a search like :

index=* | stats count by index splunk_server

or ove the time with

index=* | timechart count by splunk_server

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...