Hardware Specification for deploying single instance splunk enterprise on microsoft azure VM (ubuntu)

[man03359]

Hello,

Hope this message finds you all well.

I have moved to the role of Splunk admin recently and I need to install Splunk enterprise package (single instance) for lab purpose. Further, splunk enterprise security and Splunk soar app will be installed on the same server as well. The lab is just for the demo and some RND purpose and the daily ingestion will be less than 100 mb. 

I have the license and the Enterprise security package from my previous lab setup.

Needed some suggestion with what vCPU, storage and RAM I should proceed with.

Thanks in advance 🙂

[marnall]

There is a minimum basic instance specification for a production-grade Splunk Enterprise deployment in this page: https://docs.splunk.com/Documentation/Splunk/9.2.1/Capacity/Referencehardware

E.g.
An x86 64-bit chip architecture
12 physical CPU cores, or 24 vCPU at 2 GHz or greater speed per core.
12 GB RAM.
A 1 Gb Ethernet NIC, optional second NIC for a management network.
A 64-bit Linux or Windows distribution. See Supported Operating Systems in the Installation Manual.

If you are just doing testing and can tolerate a lower performance, you can use lower specs.

For estimating storage requirements, it would depend on how many days of retention you would keep for your <100MB/day, and how compressible your log data is. You could throw a couple tens of gigabytes into it and see how the disk space taken by data grows.