Question

What servers should be included in the director pool?

  • 7 May 2021
  • 1 reply
  • 51 views

Userlevel 3
Badge +8

Hi 

We are adding Director to our existing environment and I am wondering if I should include both Search Heads, Backend servers, and collectors in the Director pool? And should I devide them into different pools based on their function? e.g.

- pool_1: SH01, SH02
- pool_2: Backend_01, Backend02, Backend_03
- Pool_3: Collector_01

Or simply include all the servers in a single pool? 
The collector is sending logs to all 3 backends, and the search heads are able to search in all 3 backends. 


1 reply

Userlevel 4
Badge +8

We have put all systems of one subsidiaryinto one pool, or if you are MSSP you could put all systems of one customer into one pool.

Reply