Deployment Architecture

Are there any search head to search peer recommended latency?

sdpazoki
New Member

Hi there,
There are recommendations around latency between Search Head cluster members or IDX cluster members but are there any guidelines on latency requirements between search heads and search peers?

Thanks,
Saeed

0 Karma

skalliger
Motivator

There are but I think you have to contact support or PS for details about your environment.
Some basics are listed here: https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware
I think a rule of thumb is, for a single site, stay below 100ms.

Edit: Corrected the 150 to 100ms.

Skalli

0 Karma

sdpazoki
New Member

Hi Skalli,
Thanks for your response. Yeah I got the figures for accepted latency between search head peers or indexer members from that same document but there is no reference for latency between search heads and indexers.

Saeed

0 Karma

skalliger
Motivator

I just asked some colleagues and found out that this got documented: https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware

For indexer cluster nodes, network latency should not exceed 100 milliseconds.

Skalli

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...