topic What is the recommended hardware requirement for Heavy Forwarder that is indexing? in Getting Data In

What is the recommended hardware requirement for Heavy Forwarder that is indexing?

slebbie_splunk — Thu, 23 Mar 2017 03:30:39 GMT

What is the recommended hardware spec for a HF that is now indexing locally. Essentially, I know it's an Indexer that is just forwarding, so do we treat it as such in terms of hardware requirements?

12CPU? 12GB?

Re: What is the recommended hardware requirement for Heavy Forwarder that is indexing?

esix_splunk — Thu, 23 Mar 2017 03:39:26 GMT

You can follow the reference architecture listed in docs. But what kind indexing volume is this box doing per day?

Without search load, 12gb + 12cores, and 900iops, should be able to deliver 200gb+ a day.

Re: What is the recommended hardware requirement for Heavy Forwarder that is indexing?

slebbie_splunk — Thu, 23 Mar 2017 14:12:29 GMT

To be honest, not much. 1.5gb. But there are massive blocked queues. Currently it's a 4 core box, more than likely a VM.

Re: What is the recommended hardware requirement for Heavy Forwarder that is indexing?

jet1276 — Tue, 18 Sep 2018 06:01:04 GMT

I have seen Heavy Forwarder with 12 Core CPU and 12 GB RAM handling 500 GB/day logs.

But everything depends on how you configure the Splunk Deployment and Server configurations.

Re: What is the recommended hardware requirement for Heavy Forwarder that is indexing?

edoardo_vicendo — Thu, 30 Nov 2023 17:12:13 GMT

Hello,

Do you mean the 200GB/day is for an 12vCPU/12GB RAM/900 IOPS Heavy Forwarder that is indexing locally and also forwarding to Indexers but not performing local searches?

In this 200GB/day are you also including logs from internal indexes ( index=_* ) ?

If so, what about an Heavy Forwarder with same specs that is not locally indexing? How many GB/day can process (internal and non internal logs)?

Thanks a lot,

Edoardo