Setting up Search Heads for Faster Peer Searches

If you have several peered Loggers and many users that need to search at the same time, you can set up your Loggers so that some of them are used for receiving, storing, and forwarding events, and others are used only for searching their peers.

A node is any peered Logger used for receiving, storing, and forwarding events. A search head is a peered Logger that is only used for searching. Search heads do not forward, receive, or store events. To take advantage of search heads, you must set up your architecture so that no data is sent to the Loggers that will be used as the search heads.

Tip: For best search speed, both nodes and search heads require a minimum of 16 GB RAM. Micro Focus recommends 32 GB RAM.

Once this configuration is in place, ten users can log into the search head and run searches across ten specified nodes at the same time. You can scale this out to enable 100 users to run concurrent searches by setting up ten search heads.