All Apps and Add-ons

Hardware Specification for deploying single instance splunk enterprise on microsoft azure VM (ubuntu)

man03359
Communicator

Hello,

Hope this message finds you all well.

I have moved to the role of Splunk admin recently and I need to install Splunk enterprise package (single instance) for lab purpose. Further, splunk enterprise security and Splunk soar app will be installed on the same server as well. The lab is just for the demo and some RND purpose and the daily ingestion will be less than 100 mb. 

I have the license and the Enterprise security package from my previous lab setup.

Needed some suggestion with what vCPU, storage and RAM I should proceed with.

 

Thanks in advance 🙂

0 Karma

marnall
Motivator

There is a minimum basic instance specification for a production-grade Splunk Enterprise deployment in this page: https://docs.splunk.com/Documentation/Splunk/9.2.1/Capacity/Referencehardware

E.g.
An x86 64-bit chip architecture
12 physical CPU cores, or 24 vCPU at 2 GHz or greater speed per core.
12 GB RAM.
A 1 Gb Ethernet NIC, optional second NIC for a management network.
A 64-bit Linux or Windows distribution. See Supported Operating Systems in the Installation Manual.

If you are just doing testing and can tolerate a lower performance, you can use lower specs.

For estimating storage requirements, it would depend on how many days of retention you would keep for your <100MB/day, and how compressible your log data is. You could throw a couple tens of gigabytes into it and see how the disk space taken by data grows.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...