Does more indexers contribute to the performance of search on search head?
I found when i launch a search in the search head, every time there is only one indexer in my indexers group running
. And the event scanning speed is not faster than all the things done within a single splunk instance.
I wonder if the more indexers there are, the faster search speed it is?
YES.
More indexers, means that the events are balanced between multiple instances, each of them will have a less data to search over, and it will be parallelized.
Make sure that your forwarder are loadbalancing between your indexers.
You can verify why a search like :
index=* | stats count by index splunk_server
or ove the time with
index=* | timechart count by splunk_server