Setting up Splunk from the scratch

VijaySrrie — Tue, 05 Jul 2022 17:33:27 GMT

Hi,

implementing Splunk for the very first time in a new project

Need to do set up Splunk from the scratch

Multi site clustered env
2 TB License

How to calculate the number of Indexers and Search heads?
Please let me know the end to end steps to take care of

Re: Splunk Implementation -set up Splunk from the scratch

gcusello — Mon, 04 Jul 2022 11:08:24 GMT

an installation for 2TB of logs isn't an immediate architecture, and it isn't a good idea to design it in this way.

I hint to engage a Splunk Professional Service or at least a Splunk Architect to design it.

Anyway, the number of Indexers depends on many factors:

Anyway, if you haven't ES or ITSI, you should use around 10 Indexers.

the hardware reference depends on the number of users and scheduled searches (https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware).

At the same time, you should also design the number of Search Heads and the other components of the Splunk architecture.

For all these reasons, I hint to engage an Architect!

Ciao.

Giuseppe