Architecture Question for distributed deployment

[wompRS]

I have a multi-site infrastructure with VM host at each site and a central datacenter that it all reaches back to. I am setting up a new Security Onion deployment and want to confirm best practice for Search nodes. I have a forward sensor at each site, but the question is whether to make 2 or 3 search nodes at the central location (where the manager node is), or to make a search node at each site.

[tomjones1977]

The search nodes should be with your manager node, closest (from a network perspective) to your analysts.