We are upgrading from Splunk 6.1 to 6.3, but the problem we are facing is that now is we are supporting a search head pool with 2 physical servers and 1 virtual with lower hardware. Since each server has its own config, it's not a big deal. We have the virtual out of the balancer and only use it through the API for some apps. With 6.3, if you want a cluster, the minimum number of nodes is 3, but I have read from the docs:
*"Splunk recommends that you use homogeneous machines with identical hardware specifications for all cluster members. The reason is because the cluster captain assigns scheduled jobs to members based on their current job loads. When it does this, it does not have insight into the actual processing power of each member's machine. Instead, it assumes that each machine is provisioned equally."*
Is there no way to create a search head cluster where a server has less weight than the others? Is only the scheduled jobs the main problem?
↧