topic Re: Indexers hardware in Getting Data In

Indexers hardware

ccuenot — Wed, 06 Mar 2013 14:19:18 GMT

Hi,

We have planne to install 2 indexers in cluster + 1 VM for search HEAD and 1 VM as master node.
We will start with 50GB/day of indexes data.
We would like to know if someone know the indexer limitation (how many log/by day) on this kind of hardware :
8 core at 2,40Ghz
4 x 8GO RAM
DD Local : 300GB + storage NAS > 1200 IOPS

Thanks by advance.
Chris

Re: Indexers hardware

alacercogitatus — Wed, 06 Mar 2013 14:40:44 GMT

You probably want to review this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Installation/Systemrequirements#Recommended_hardware

Based on those specs, you should be ok on the indexers. Just make sure your VMs have enough CPU and RAM to run searches.

Re: Indexers hardware

ccuenot — Wed, 06 Mar 2013 15:24:26 GMT

Thanks for your answer, but in fact, I would like to know, based on the indexer hardware, the limitation (how many logs is it possible to manage with this hardware) ?

This is a pure capacity planning constraint for a futur usage.

Re: Indexers hardware

alacercogitatus — Wed, 06 Mar 2013 15:42:53 GMT

You will then probably also want to review this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Installation/CapacityplanningforalargerSplunkdeployment. As long as your VMs can support searching (8 cores and 8 GB RAM), your current configuration should support 50GB/day indexing. The "How many logs" question is answered by "how much" you are indexing. As many logs as it takes to hit 50GB/day.