https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443410#M3723 <P>The 300GB would be recommended by Search Heads with large number of user/user searches (required for dispatch directory and configs mostly). Other components (Intermediate Forwarders/Deployment Servers/SHC Deployers) would not have that much space requirements and probably 100 GB would be more that sufficient. For indexers also, excluding the $Splunk_Home/var/lib (index storage), 100 GB would be more than sufficient.</P> Thu, 12 Jul 2018 20:52:05 GMT somesoni2 2018-07-12T20:52:05Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443409#M3722 <P>Hello,</P> <P>My server operations team is standing up a set of Splunk servers for me to set up a distributed Splunk deployment. FYI - we are keeping a separate path for storage of indexed data. They want to know how much space should be provisioned just to support the base Splunk software, exclusive of the indexed data.</P> <P>I did some research into Splunk reference hardware. For search heads, I see that the recommendation is:</P> <P>2 x 300GB, 10,000 RPM SAS hard disks, configured in RAID 1</P> <P>Is 300 GB worth of space the rule of thumb I should be using for $SPLUNK_HOME? </P> <P>Thanks!</P> Thu, 12 Jul 2018 20:20:25 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443409#M3722 vanderaj2 2018-07-12T20:20:25Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443410#M3723 <P>The 300GB would be recommended by Search Heads with large number of user/user searches (required for dispatch directory and configs mostly). Other components (Intermediate Forwarders/Deployment Servers/SHC Deployers) would not have that much space requirements and probably 100 GB would be more that sufficient. For indexers also, excluding the $Splunk_Home/var/lib (index storage), 100 GB would be more than sufficient.</P> Thu, 12 Jul 2018 20:52:05 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443410#M3723 somesoni2 2018-07-12T20:52:05Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443411#M3724 <P>Thank you! That is very helpful....</P> Wed, 18 Jul 2018 14:13:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443411#M3724 vanderaj2 2018-07-18T14:13:23Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443412#M3725 <P>@vanderaj2 if it answers your question, kindly accept the answer for others to see it worked for you</P> Wed, 18 Jul 2018 14:53:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443412#M3725 adonio 2018-07-18T14:53:43Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443413#M3726 <P>For indexed data, you will want to calculate you anticipated capacity. Start by determining how much you will index each day. Then take into account your retention settings. </P> <P>For instance, let's say that you will be ingesting a 1 GB of data each day and that you want a retention period of 2 years. This means that in two years you will be storing 730GB of data. </P> <P>I would get some estimates on what you expect/ need and go from there.</P> Mon, 23 Jul 2018 20:35:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443413#M3726 cstump_splunk 2018-07-23T20:35:07Z https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443414#M3727 <P>Splunk has good compression capability, avg 50%<BR /> also things get another angle with ES or ITSI or any major use of DM Acceleration<BR /> in general, this is the basic formulas Splunk uses, frmo docs:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/Capacity/HowSplunkcalculatesdiskstorage">http://docs.splunk.com/Documentation/Splunk/7.1.2/Capacity/HowSplunkcalculatesdiskstorage</A></P> Mon, 23 Jul 2018 21:13:21 GMT https://community.splunk.com/t5/Monitoring-Splunk/Does-anyone-know-the-base-recommended-amount-of-disk-space-for/m-p/443414#M3727 adonio 2018-07-23T21:13:21Z