topic Re: Distributed search sizing in Deployment Architecture

Distributed search sizing

ontai — Thu, 17 May 2012 21:56:46 GMT

I've looked through some of the documentation for separating search heads from indexers depending on the number of concurrent searches and users. I'm wondering what a rough idea of the architecture and hardware requirements would look like to support:

10-20 GB per day
20 concurrent users
10 concurrent saved searches

Thanks.

Craig

Re: Distributed search sizing

Takajian — Thu, 17 May 2012 23:16:54 GMT

I do not think you do not need dedicated search head when you index data less than 100GB per day on one box server. You can also refer to following site. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment

Re: Distributed search sizing

araitz — Fri, 18 May 2012 00:43:09 GMT

Given your user and scheduler concurrency, you would probably be best off implementing an indexer and a search head. Although you can easily index 80-100 GB/day on a single commodity server, having 20 concurrent users and 10+ concurrent scheduled searches on the same machine wouldn't allow for the best user experience or much room for growth.

Re: Distributed search sizing

Takajian — Fri, 18 May 2012 00:47:49 GMT

I agree your suggestion. This is appropriate sizing with considering to future plan. My answer was rough idea.