Skip to main content

Hi 

We are adding Director to our existing environment and I am wondering if I should include both Search Heads, Backend servers, and collectors in the Director pool? And should I devide them into different pools based on their function? e.g.

- pool_1: SH01, SH02
- pool_2: Backend_01, Backend02, Backend_03
- Pool_3: Collector_01

Or simply include all the servers in a single pool? 
The collector is sending logs to all 3 backends, and the search heads are able to search in all 3 backends. 

We have put all systems of one subsidiaryinto one pool, or if you are MSSP you could put all systems of one customer into one pool.


Reply