https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173772#M7664 <P>I'd swap the cores around, giving the search head more oomph.</P> Tue, 04 Mar 2014 21:34:15 GMT martin_mueller 2014-03-04T21:34:15Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173771#M7663 <P>Does this seem like a good setup for a dedicated Search head, indexer for a virtualized Splunk?</P> <P>Search Head<BR /> - 8 core 16 GB Ram</P> <P>Indexer<BR /> - 8 core 8 GB Ram 1 TB Hard Drive</P> <P>We will have approximately 3 concurrent users at a given time, and a throughput of 10 GB/day</P> Tue, 04 Mar 2014 19:55:10 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173771#M7663 aelliott 2014-03-04T19:55:10Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173772#M7664 <P>I'd swap the cores around, giving the search head more oomph.</P> Tue, 04 Mar 2014 21:34:15 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173772#M7664 martin_mueller 2014-03-04T21:34:15Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173773#M7665 <P>I have modified my post, does that look much better?</P> Tue, 04 Mar 2014 21:58:10 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173773#M7665 aelliott 2014-03-04T21:58:10Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173774#M7666 <P>Bear in mind that indexing performance is about 30% slower on a virtual machine. Search performance is about equivalent to physical hardware.</P> Wed, 05 Mar 2014 00:09:02 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173774#M7666 ChrisG 2014-03-05T00:09:02Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173775#M7667 <P>Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...</P> Wed, 05 Mar 2014 08:07:47 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173775#M7667 martin_mueller 2014-03-05T08:07:47Z https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173776#M7668 <P>finally have the power to convert to answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks for your help martin.</P> Wed, 19 Mar 2014 19:44:33 GMT https://community.splunk.com/t5/Knowledge-Management/Recommended-Virtual-Machine-Sizes-for-Search-Head-and-Indexer/m-p/173776#M7668 aelliott 2014-03-19T19:44:33Z