https://community.splunk.com/t5/Splunk-Enterprise-Security/Deployment-Sizing-on-AWS/m-p/465347#M6933 <P>We are deploying Enterprise Security for various clients on AWS, and are in the planning phase. I am attempting to create reference documentation that would contain the minimum instance type and number of instances per deployment, with a more granular breakdown in terms of capacity.</P> <P>We also want to provide the following in all deployments:<BR /> - HA/DR (somewhat) - So the deployment would contain of a multi-site indexer cluster as well as a search head cluster<BR /> - Monitoring Console,Deployment server where neccesary but reduce need for extra instances so group roles where possible (I chose License manager + Deployer and Cluster master node + Deployment Server + Monitoring Console<BR /> - Searching of up to around 8-16 users<BR /> - Use of smart store for indexer storage<BR /> - Use smallest possible instances where possible<BR /> - Mainly used for ES<BR /> - Hopefully utilize placement groups, kubernetes and other services on cloud in the future when supported by splunk (believe this is soon)</P> <P>I am also aware that:<BR /> - Each deployment/client will be different even if they have the same ingestion rate<BR /> - Splunk recommendations have pretty big gaps e.g 2-300GB is 1 SH and 1Indexer whereas I am trying to break it down a bit more like 25-50, 50-100,100-300, 300-600, etc<BR /> - Instance types , and prices change..again this is just for reference</P> <P>Has anyone done something similar?</P> Wed, 12 Feb 2020 05:01:02 GMT ajiwanand 2020-02-12T05:01:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Deployment-Sizing-on-AWS/m-p/465347#M6933 <P>We are deploying Enterprise Security for various clients on AWS, and are in the planning phase. I am attempting to create reference documentation that would contain the minimum instance type and number of instances per deployment, with a more granular breakdown in terms of capacity.</P> <P>We also want to provide the following in all deployments:<BR /> - HA/DR (somewhat) - So the deployment would contain of a multi-site indexer cluster as well as a search head cluster<BR /> - Monitoring Console,Deployment server where neccesary but reduce need for extra instances so group roles where possible (I chose License manager + Deployer and Cluster master node + Deployment Server + Monitoring Console<BR /> - Searching of up to around 8-16 users<BR /> - Use of smart store for indexer storage<BR /> - Use smallest possible instances where possible<BR /> - Mainly used for ES<BR /> - Hopefully utilize placement groups, kubernetes and other services on cloud in the future when supported by splunk (believe this is soon)</P> <P>I am also aware that:<BR /> - Each deployment/client will be different even if they have the same ingestion rate<BR /> - Splunk recommendations have pretty big gaps e.g 2-300GB is 1 SH and 1Indexer whereas I am trying to break it down a bit more like 25-50, 50-100,100-300, 300-600, etc<BR /> - Instance types , and prices change..again this is just for reference</P> <P>Has anyone done something similar?</P> Wed, 12 Feb 2020 05:01:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Deployment-Sizing-on-AWS/m-p/465347#M6933 ajiwanand 2020-02-12T05:01:02Z