https://community.splunk.com/t5/Security/Specification-for-web-server/m-p/50840#M1664 <P>Hi,</P> <P>We are planning to deploy the web service on a dedicated server, can you please let me know the recommended hardware specification?</P> <P>Regards</P> <P>David</P> Sun, 27 Feb 2011 18:00:41 GMT davidxinli 2011-02-27T18:00:41Z https://community.splunk.com/t5/Security/Specification-for-web-server/m-p/50840#M1664 <P>Hi,</P> <P>We are planning to deploy the web service on a dedicated server, can you please let me know the recommended hardware specification?</P> <P>Regards</P> <P>David</P> Sun, 27 Feb 2011 18:00:41 GMT https://community.splunk.com/t5/Security/Specification-for-web-server/m-p/50840#M1664 davidxinli 2011-02-27T18:00:41Z https://community.splunk.com/t5/Security/Specification-for-web-server/m-p/50841#M1665 <P>Just to be clear, the web service still needs a full installation of Splunk, though it would not necessarily perform any indexing. What you're looking for is a dedicated <A href="http://www.splunk.com/base/Documentation/4.1.7/Admin/Installadedicatedsearchhead" rel="nofollow">search head</A>.</P> <P>To get started, look here: <A href="http://www.splunk.com/base/Documentation/4.1.7/Installation/CapacityplanningforalargerSplunkdeployment#Dividing_up_indexing_and_searching" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/Installation/CapacityplanningforalargerSplunkdeployment#Dividing_up_indexing_and_searching</A></P> <P>In broad terms, shoot for at least one core per concurrent user, plus another one or two for scheduled search jobs. CPU and RAM will be considerably more important than disk. (Most of the disk load is on indexers, not search heads).</P> Mon, 28 Feb 2011 06:21:00 GMT https://community.splunk.com/t5/Security/Specification-for-web-server/m-p/50841#M1665 southeringtonp 2011-02-28T06:21:00Z