topic Re: Does anyone have personal experience-based hardware recommendations for these requirements? in Getting Data In

Does anyone have personal experience-based hardware recommendations for these requirements?

noybin — Fri, 25 Aug 2017 14:09:54 GMT

Hello,

I need hardware recommendations for the following scenario:

1 Search Head
Indexer Cluster (search factor 2) (2 members)
1 Master Node
1 Heavy Forwarder (or cluster if possible)

7GB of events per day
50 alarms (no real time)
100 data sources

Also I would like to know if it is possible to have high availability on the heavy forwarders and how can it be achieved.

Thank you very much.

Re: Does anyone have personal experience-based hardware recommendations for these requirements?

richgalloway — Fri, 25 Aug 2017 17:34:18 GMT

See the Splunk reference hardware specification at http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Referencehardware.

Re: Does anyone have personal experience-based hardware recommendations for these requirements?

noybin — Fri, 25 Aug 2017 18:30:13 GMT

Thank's for your answer.

I've already read that document and it specifies different possible alternatives.

I was wondering if someone who has experience with a similar enviroment that mine, can recommend me based on the experience.

Thank's again

Re: Does anyone have personal experience-based hardware recommendations for these requirements?

richgalloway — Fri, 25 Aug 2017 21:07:20 GMT

You should be fine going with the lowest specs in the "Reference host specification for distributed deployments" section. Treat your Master Node and Heavy Forwarder as search heads.

Re: Does anyone have personal experience-based hardware recommendations for these requirements?

noybin — Tue, 29 Aug 2017 15:15:39 GMT

Thank you very much